Caller Context element
The Caller Context element validates an inbound caller’s credential and populates input.source_auth for policy evaluation. Drop it on the Caller → Access Point request edge. Only one instance is allowed per surface.
Without this element, all callers are treated as anonymous. Adding it does not block a request on its own when validation fails: a missing or invalid credential is recorded as a failed authentication attempt, and only a policy rule that checks input.source_auth.method denies the request. A surface with no such rule forwards the request as if Caller Context were not configured.
The compact sidebar panel shows only the method selector and a Configure… button. All method-specific fields open in the fullscreen editor.
Core field
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Authentication Method | select | Yes | JWT Bearer | The credential type the gateway accepts. Options: JWT Bearer, API Key (secret store), API Key (provider), DID Auth. mTLS (Mutual TLS) is visible in the dropdown but not currently available. |
Method: JWT Bearer
Validates incoming requests using a bearer token verified against a configured JWT verification strategy. A missing or invalid token does not block the request by itself: it is recorded as a failed authentication attempt on input.source_auth, and a policy rule must check that field to deny the caller. A server-side failure, such as a JWT verification strategy that no longer exists, returns 500 Internal Server Error instead.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| JWT Verification Strategy | select | Yes | — | Strategy (issuer, JWKS, audience) selected from the configured JWT Verification Strategies. |
| Accepted Audiences | string[] | No | [] | Accepted audience values. The JWT aud claim must match one of these when the list is non-empty. Strongly recommended: without an audience, tokens issued for other services are accepted. The literal value {{ surface.agent_did }} is a reserved template: the gateway resolves it to this surface’s own agent DID at request time, so you can bind the audience check to the surface’s own identity without knowing that DID in advance. |
| Token Header | string | No | Authorization | HTTP header the JWT is read from. |
| Scheme | string | No | Bearer | Prefix stripped from the header value before JWT parsing. Leave blank if the header carries the raw token. |
| Forward token header to managed agent | bool | No | Off | Sends the validated JWT header unchanged to the directly managed target. Never applied to mirrors or fabric hops. |
Method: API Key (secret store)
Compares the presented credential against a stored secret.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| API Key Location | radio | No | HTTP Header | Where the key is located. HTTP Header: transport-level, works with all protocols. Protocol-Specific: MCP _meta field or A2A extension point. |
| HTTP Header Name / Protocol Field Name | string | No | X-API-Key | Header name when HTTP Header is selected; field name when Protocol-Specific is selected. |
| Secret ID | select | Yes | — | API key secret to validate against. Populated from the gateway’s configured API key secrets. |
Method: API Key (provider)
Delegates API key verification to this surface itself. Create API keys from the API Keys page using this surface’s ID as the agent. No additional configuration is required here.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| API Key Location | radio | No | HTTP Header | Where the key is located. HTTP Header: transport-level. Protocol-Specific: MCP _meta or A2A extension point. |
| HTTP Header Name / Protocol Field Name | string | No | X-API-Key | Header name or field name the key is read from. |
| Agent ID | string | Read-only | Surface ID | Auto-set to this surface’s ID. Manage API keys for this agent from the API keys page. |
Method: DID Auth
Callers authenticate with a signed session token tied to their decentralized identifier (DID). Reach for this when the caller’s identity is already a DID and you want the gateway to bind that identity, rather than a bearer token or API key, to the request.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Session Token Location | radio | No | HTTP Header | Where the token is located. HTTP Header or Protocol-Specific. |
| HTTP Header Name / Protocol Field Name | string | No | X-Session-Token | Header name or field name to read the token from. |
Method: mTLS
mTLS is visible in the method dropdown but is disabled and cannot be selected.
Trusts the TLS-terminated client certificate presented by the caller.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Client Certificate | select | Yes | — | Active client certificate to validate against. Populated from the gateway’s configured certificates. |
Related
- OPA policies reference: how
input.source_authis populated for policies. - JWT Verification Strategies reference: strategy fields and token validation sequence.
- API keys reference: creating and managing API keys for provider mode.
- Access Point reference: inbound configuration and how Caller Context attaches.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.