Secure access
Control which callers can reach a surface and on what terms. Caller authentication and identity derivation determine who gets in. Field-level reference for Secrets and API Keys is in the Reference section.
| Guide | What you will achieve |
|---|---|
| Restrict surface access with API key authentication | Add a Caller Context element and Rate Limit to a surface so only callers with a valid API key can reach your managed agent. |
| Limit surface access by agent identity | Derive a stable DID for each agent on a surface and gate requests using an OPA policy that checks agent identity. |
| Validate bearer tokens on a surface | Create a JWT verification strategy and attach it to a surface so the gateway validates bearer tokens from callers. |
Was this page helpful?
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.