# Secure access
Control which callers can reach a surface and on what terms. Caller authentication and identity derivation determine who gets in. Field-level reference for [Secrets](/products/affinidi-trust-fabric/agent-gateway/reference/authentication/secrets.md) and [API Keys](/products/affinidi-trust-fabric/agent-gateway/reference/authentication/api-keys.md) is in the Reference section.

| Guide | What you will achieve |
| [Restrict surface access with API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/restrict-surface-access-with-api-key.md) | Add a Caller Context element and Rate Limit to a surface so only callers with a valid API key can reach your managed agent. |
| [Limit surface access by agent identity](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/limit-surface-access-by-agent-identity.md) | Derive a stable DID for each agent on a surface and gate requests using an OPA policy that checks agent identity. |
| [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/validate-bearer-tokens-on-a-surface.md) | Create a JWT verification strategy and attach it to a surface so the gateway validates bearer tokens from callers. |


## Pages in this section


- [Restrict surface access with API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/restrict-surface-access-with-api-key.md): Add a Caller Context element and a Rate Limit to an A2A or MCP surface so only callers with a valid API key can reach your managed agent.

- [Limit surface access by agent identity](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/limit-surface-access-by-agent-identity.md): Add an Identity element to a surface to derive a stable DID for each agent, then write an OPA policy that gates requests based on that identity.

- [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/validate-bearer-tokens-on-a-surface.md): Create a JWT verification strategy in the Agent Gateway dashboard and attach it to a surface to validate bearer tokens from callers.