Skip to main content

​
Establish authority

  1. Create the agent identity in the intended organization and environment (in the portal, or POST /api/v1/agents/identities).
  2. Register an OAuth machine client and link it to that agent (/api/v2/oauth/clients).
  3. Register its public JWK and complete proof of possession. Keep the private key outside the portal, in the workload’s protected configuration or signing service.
  4. Obtain approval for the exact resource and required scopes.
  5. Configure MachineAgent.from_env() and verify a request to that resource.
Use the quickstart for the complete process configuration. A linked client without an approved grant has no resource authority.

​
Manage changes

Request only the scopes needed by the workload. If its resource or scope set changes, update the approved grant and configure the client with the intended identity. For key replacement, use the client’s key management and proof-of-possession flow. See Rotate client keys and secrets. Suspension and containment can prevent new access. An existing token may still be accepted by an offline verifier until expiry. Live enforcement depends on the resource integration. An enforcement hold requires an authorized restore; changing an agent status alone must not bypass containment. Use the same setup in sandbox and production, with the appropriate environment configuration. Native agent credentials — an api_key_id + secret from POST /api/v1/agents/register — are retired; that route returns 410 Gone.