Secure access

Control which callers can reach a surface and on what terms. Caller authentication and identity derivation determine who gets in. Field-level reference for Secrets and API Keys is in the Reference section.

GuideWhat you will achieve
Restrict surface access with API key authenticationAdd a Caller Context element and Rate Limit to a surface so only callers with a valid API key can reach your managed agent.
Limit surface access by agent identityDerive a stable DID for each agent on a surface and gate requests using an OPA policy that checks agent identity.
Validate bearer tokens on a surfaceCreate a JWT verification strategy and attach it to a surface so the gateway validates bearer tokens from callers.