# Multi-client authentication

> Isolate credentials per client and enforce route-level access control.
As your ecosystem grows, managing access across multiple clients, partners, and services becomes increasingly complex. Shared credentials introduce security risks, limited visibility, and operational friction.

## What you can do

- Assign unique API keys per client, partner, or application.

- Protect specific routes and services independently.

- Support multiple authentication headers, especially for MCP-based integrations.

## How it works

Define access controls at the gateway layer and map credentials to specific routes or services. Each client operates in an isolated authentication context.

For implementation details, see [Configure API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides.md).

## Related

- [Configure API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/restrict-surface-access-with-api-key.md): Step-by-step guide to enabling API key source authentication on a surface.

- [OPA policies](/products/affinidi-trust-fabric/agent-gateway/concepts/opa-policies.md): How gateway and surface policies enforce route-level access control.