Caller Context element

Field reference for the Caller Context canvas element: authentication method selection and per-method credential extraction configuration.

The Caller Context element requires an authenticated credential from inbound callers before any policy, payment, or routing control runs. Drop it on the Caller → Access Point request edge. Only one instance is allowed per surface.

Without this element, all callers are treated as anonymous. Adding it requires credentials at the surface boundary and populates input.caller_auth in OPA policies.

Note

The compact sidebar panel shows only the method selector and a Configure… button. All method-specific fields open in the fullscreen editor.

Core field

Field	Type	Required	Default	Description
Authentication Method	select	Yes	JWT Bearer	The credential type the gateway accepts. Options: JWT Bearer, API Key (secret store), API Key (provider). DID Auth and mTLS (Mutual TLS) are visible in the dropdown but not currently available.

Method: JWT Bearer

Validates incoming requests using a bearer token verified against a configured JWT verification strategy. Requests without a valid token receive 403 Forbidden.

Field	Type	Required	Default	Description
JWT Verification Strategy	select	Yes	—	Strategy (issuer, JWKS, audience) selected from the configured JWT Verification Strategies.
Accepted Audiences	string[]	No	`[]`	Accepted audience values. The JWT `aud` claim must match one of these when the list is non-empty. Strongly recommended: without an audience, tokens issued for other services are accepted.
Token Header	string	No	`Authorization`	HTTP header the JWT is read from.
Scheme	string	No	`Bearer`	Prefix stripped from the header value before JWT parsing. Leave blank if the header carries the raw token.

Method: API Key (secret store)

Compares the presented credential against a stored secret.

Field	Type	Required	Default	Description
API Key Location	radio	No	HTTP Header	Where the key is located. HTTP Header: transport-level, works with all protocols. Protocol-Specific: MCP `_meta` field or A2A/UCP extension point.
HTTP Header Name / Protocol Field Name	string	No	`X-API-Key`	Header name when HTTP Header is selected; field name when Protocol-Specific is selected.
Secret ID	select	Yes	—	API key secret to validate against. Populated from the gateway’s configured API key secrets.

Method: API Key (provider)

Delegates API key verification to this surface itself. Create API keys from the API Keys page using this surface’s ID as the agent. No additional configuration is required here.

Field	Type	Required	Default	Description
API Key Location	radio	No	HTTP Header	Where the key is located. HTTP Header: transport-level. Protocol-Specific: MCP `_meta` or A2A/UCP extension point.
HTTP Header Name / Protocol Field Name	string	No	`X-API-Key`	Header name or field name the key is read from.
Agent ID	string	Read-only	Surface ID	Auto-set to this surface’s ID. Manage API keys for this agent from the API keys page.

Method: DID Auth

Not currently available

DID Auth is visible in the method dropdown but is disabled and cannot be selected.

Verifies a DID-based session token presented by the caller.

Field	Type	Required	Default	Description
Session Token Location	radio	No	HTTP Header	Where the token is located. HTTP Header or Protocol-Specific.
HTTP Header Name / Protocol Field Name	string	No	`X-Session-Token`	Header name or field name to read the token from.

Method: mTLS

Not currently available

mTLS is visible in the method dropdown but is disabled and cannot be selected.

Trusts the TLS-terminated client certificate presented by the caller.

Field	Type	Required	Default	Description
Client Certificate	select	Yes	—	Active client certificate to validate against. Populated from the gateway’s configured certificates.

OPA policies reference: how input.caller_auth is populated for policies.
JWT Verification Strategies reference: strategy fields and token validation sequence.
API keys reference: creating and managing API keys for provider mode.
Access Point reference: inbound configuration and how Caller Context attaches.

Was this page helpful?

Glad to hear it! Please tell us how we can improve more.

Sorry to hear that. Please tell us how we can improve.

Thank you for sharing your feedback so we can improve your experience.