Configure per-caller Credential Delegation

Create a credential provider for GitHub

1. In the sidebar, select Credentials, then select the Credential Providers tab.
2. Select Add Credential Provider.
3. Fill in the fields:

4. Confirm the Callback URL shown on the form matches what you entered in your GitHub App: https://GATEWAY_HOST/v1/identity/oauth/callback/github.
5. Select Save.

Set the Managed Agent target

1. Open your MCP surface in the canvas.
2. Select the Managed Agent node.
3. Set the Target Endpoint to https://api.githubcopilot.com/mcp/.
4. Close the editor.

Add Caller Context

1. Drag a Caller Context element from the palette onto the canvas.
2. Select the Caller Context node.
3. Set Authentication Method to JWT Bearer.
4. Accept the default Header (Authorization) and Scheme (Bearer).
5. Close the editor.

Add the Identity element

The Identity element derives a stable per-caller DID from the validated credential. This DID appears as the workload identity in audit records and workload binding attestations.

1. Drag an Identity element from the palette onto the canvas.
2. Select the Identity node.
3. Set Type to From JWT claim.
4. Set Claim to sub. Use oid if your identity provider is Microsoft Entra.
5. Close the editor.

Enable Credential Delegation

1. Drag a Credential Delegation element from the palette and connect it to the Managed Agent node.

2. Configure the credential binding:

   Field	Value
   Credential Provider	GitHub
   Scopes	repo read:user
   Consent Mode	On demand
   Required For	All outbound requests
   Inject As	Bearer header

   Consent Mode controls what the agent receives on the first call when no token is stored yet.

   Mode	What the agent receives	When to use
   On demand (default)	A consent_required response with the authorisation URL. The agent or client retries after the user completes OAuth.	Most clients. No MCP-specific support required.
   Pre-authorize	The session is blocked at initialisation. OAuth must complete before any tool call proceeds.	Clients that can display an auth prompt before the session starts.
   Elicit	An inline MCP elicitation prompt. The gateway holds the tool call open while OAuth completes, then resumes automatically.	Clients that support MCP elicitation. No out-of-band retry required.

   Required For — All outbound requests means the gateway checks for a stored GitHub token before every forwarded call, including tools/list. If no token is stored for this caller, the gateway returns a consent_required response immediately without forwarding the request.

3. Close the editor.

Save the surface

Select the green checkmark (Create surface) or Save changes. Changes apply immediately through hot reload.

On every subsequent request the gateway:

1. Authenticates the caller via Authorization: Bearer (or X-API-Key header for API key auth).
2. Derives the caller’s unique identity from the JWT claim (or from the API key if using API key auth).
3. Checks for a stored OAuth token for that identity. If none is stored, returns consent_required.
4. Injects the token as Authorization: Bearer <oauth-token> on the forwarded request to api.githubcopilot.com/mcp/.

Restrict access by Entra group membership (optional)

If callers authenticate with Microsoft Entra, add a surface-scope OPA policy to restrict access to specific security groups.

From the surface palette, drag a Policy element onto the canvas and open the policy editor. Enter:

package surface.policy

default allow := false

allow if {
    input.caller.jwt_bearer != null
    input.caller.jwt_bearer.iss == "https://login.microsoftonline.com/TENANT_ID/v2.0"
    "ALLOWED_GROUP_ID" in input.caller.jwt_bearer.groups
    not "RESTRICTED_GROUP_ID" in input.caller.jwt_bearer.groups
}

Replace TENANT_ID, ALLOWED_GROUP_ID, and RESTRICTED_GROUP_ID with values from your Entra configuration. Save and publish the policy.