# Call an agent protected by Entra or Google OAuth tokens > Create a JWT Bearer or Client Credentials JWT credential provider, such as a Google service account or an Entra certificate credential, and use it as the Target Authentication of a Managed Agent or Transit Point so the gateway obtains and renews the agent's OAuth token itself. This guide sets up a credential provider that signs its own token requests, and makes the gateway send the resulting OAuth token to your managed agent or to a Transit Point’s upstream. The gateway caches each token and renews it before it expires. For how providers work, see [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md). An agent protected by Google Cloud IAM or Microsoft Entra ID usually accepts only short-lived OAuth tokens, so a static secret in Target Authentication stops working when the token expires. A JWT Bearer or Client Credentials JWT provider lets the gateway obtain a fresh token with a signing key instead of a client secret. Use this guide when: - Your managed agent runs behind Google Cloud, for example on Vertex AI Agent Engine, and accepts tokens for a Google service account. - Your managed agent, or a Transit Point’s upstream, accepts Entra tokens and its app registration uses a certificate credential. - The gateway needs to fetch an A2A agent card that requires a token. You do not need this guide if each caller signs in with their own account. For per-user tokens, see [Configure per-caller Credential Delegation](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/configure-per-caller-credential-delegation.md). ## Prerequisites | You need | Where it comes from | | A role that can edit secrets, credential providers, and surfaces | Administrator, by default. | | A signing key for one of these accounts | Google: create a service account key in Google Cloud and download its JSON key file. Entra: upload a certificate to the Entra app registration, and keep its PEM private key and PEM certificate. | | The OAuth details of that account | Google: the scopes your agent needs. Entra: the tenant-specific token endpoint, the application’s client ID, and the scope of the API your agent exposes. | | A surface for your agent | The Managed Agent’s Endpoint Type must be Direct URL, or the surface needs a Transit Point whose Endpoint Type is Direct URL. On via Gateway Connection, the request reaches your agent through a remote gateway, which signs in to the agent itself. To start one, see [A2A surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/a2a-surface-starter.md). | ## Steps Store the signing material as secrets - Select Secrets in the sidebar, then select New Secret. - Enter a Secret Name, such as vertex-agent-key, and set Secret Type to General. - In Secret Value, paste the signing key: - Google: the whole JSON key file, up to 16 KiB. This needs version 1.0.5 or later. - Entra: the PEM private key, including its BEGIN and END lines. - Select Create Secret. - For Entra, create two more secrets the same way: one that holds the PEM certificate, with Secret Type set to Certificate, and one that holds the application’s client ID. Secret hygiene Keep the key file and private key only in the gateway’s Secrets page, and delete local copies once the secret is created. Keep them out of source code, surface configuration, and logs. To rotate a key, update the secret’s value on the Secrets page. Create the credential provider - Select Credentials in the sidebar, open the Credential Providers tab, and select Add Provider. - Enter a Name, such as Vertex agent. - Set Provider Type and fill in its fields: - Google: select OAuth 2.0, JWT Bearer (signed JWT grant). Set Token Endpoint to https://oauth2.googleapis.com/token. In Signing Key, select the key file secret. Set Issuer to the client_email value of the key file, and set Subject to the same client_email, which is the service account’s own identity without domain-wide delegation. Leave Key ID and Audience empty. The form then warns “No key ID is set.”; you can ignore it for a JSON key file, because the gateway sends the key ID from the file. - Entra: select OAuth 2.0, Client Credentials JWT (certificate, no client secret). Set Token Endpoint to your tenant-specific token URL, such as https://login.microsoftonline.com//oauth2/v2.0/token. In Client ID Secret, select the client ID secret. In Signing Key, select the private key secret, and in Certificate, select the certificate secret. Leave Audience empty. - Keep Signing Algorithm at its default: RS256 for JWT Bearer, PS256 for Client Credentials JWT. - In Default Scopes, enter the scopes the token needs, such as https://www.googleapis.com/auth/cloud-platform for Google or api:///.default for an Entra-protected API. - Select Create. The new provider appears in the Credential Providers list. Every provider type and field is described in [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md#signed-jwt-settings). Select the provider as the Target Authentication Open the surface on the canvas, then set the provider where the token should go: - Managed Agent: select the Managed Agent node. Under Target Authentication, set Authentication Type to Bearer Token and select Configure…. Set Credential Source to Credential provider, and in Credential Provider, select your provider. Keep Header Name at Authorization and Fallback Behavior at Reject request (502 Bad Gateway). - Transit Point: select the Transit Point. Under Target Authentication, select Credential Provider, then select your provider in Credential Provider. Leave Header Name and Header Format empty to send Authorization: Bearer , and keep Fallback when the credential is missing at Reject (502). The Credential Provider list offers only providers that need no user: Client Credentials, JWT Bearer, Client Credentials JWT, and API Key. Save the surface Select the save icon (tooltip: Save changes) on the canvas, or press Cmd+S (macOS) / Ctrl+S (Windows/Linux). The gateway requests its first token when a request or an agent card fetch needs one. ## Confirm ### Test 1: Agent Cards view of an A2A surface returns Fetch OK For an A2A or AP2 surface whose Managed Agent uses Direct URL and the provider, select the Managed Agent node. The panel shows Card fetch: OK. Select View agent cards, then select Refresh. Expected: Fetch shows OK, and Target Authentication shows Credential provider. ### Test 2: request through the surface returns the agent’s response Send a request to the surface’s Entry point URL with the caller credential its Access Point expects. This example uses an API key in the X-API-Key header, as in the [A2A surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/a2a-surface-starter.md): curl -X POST "" \ -H 'X-API-Key: ' \ -H "Content-Type: application/json" \ -H "A2A-Version: 0.3" \ -d '{"jsonrpc":"2.0","method":"message/send","id":1,"params":{"message":{"messageId":"test-1","role":"user","parts":[{"kind":"text","text":"Hello"}]}}}' curl -X POST "" \ -H 'X-API-Key: ' \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}' Expected: HTTP 200 with your managed agent’s response. For a Transit Point, have your managed agent make its usual call through the Transit Point. Expected: the upstream’s response, not a 502. ## Troubleshooting | Symptom | Likely cause | Fix | | Saving the provider is refused with “token_endpoint must be an https URL”. | The token endpoint uses http. | Use the provider’s https token endpoint. | | Saving the provider is refused with an error about the signing key or certificate. | The secret isn’t a PEM key or a Google JSON key file, the key doesn’t match the Signing Algorithm, or the certificate isn’t PEM. | Paste the whole key with its BEGIN and END lines, or the whole JSON key file, and keep the default algorithm for an RSA key. Choose ES256 only for an EC key on JWT Bearer. | | The JWT Bearer provider won’t save, and Subject is marked as required. | From version 1.0.6, a JWT Bearer provider needs a Subject, also when you edit an existing one or rotate its key. | Set Subject to the service account’s client_email, then save. | | The form warns “Neither a certificate nor a key ID is set.” | A Client Credentials JWT provider names neither. | Select the Certificate secret. Entra matches the signed JWT to the certificate uploaded to the app registration. | | Your provider is missing from the Credential Provider list. | It is an Authorization Code provider, which needs a user. | Use a JWT Bearer, Client Credentials JWT, or Client Credentials provider. | | Card fetch: failing with Sign-in failed. | The gateway couldn’t get a token from the provider, or the agent rejected it. | Read the cause in the Agent Cards view. Check the provider’s secrets, Issuer, Token Endpoint, and Default Scopes. | | Card fetch: failing with Needs a token. | The agent asked for a token and the gateway sent none. | Set Target Authentication on the Managed Agent, as in step 3. | | Card fetch: failing with Refused and HTTP 403. | The token lacks a scope or role the agent needs. | Grant the service account or app registration access to the agent, or add the scope to Default Scopes. | | Requests through the surface or Transit Point return 502. | The gateway couldn’t obtain a token, and the fallback is to reject the request. | Check the provider as for Sign-in failed. | ## Next steps - [Configure per-caller Credential Delegation](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/configure-per-caller-credential-delegation.md): give each caller their own OAuth token instead of the gateway’s service token. - [Restrict surface access with API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/restrict-surface-access-with-api-key.md): control which callers can reach the agent behind the surface. ## Related - [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md): provider types and the Signed JWT fields of each. - [Managed Agent](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/managed-agent.md#target-authentication): the Target Authentication fields and the Agent Cards view. - [Transit Points](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/transit-points.md): the Transit Point’s Target Authentication options. - [Secrets](/products/affinidi-trust-fabric/agent-gateway/reference/authentication/secrets.md): creating and rotating the secrets that hold the key and certificate.