Skip to main content
An identity represents an AI agent in your project. Create one for each agent (or agent instance) that will connect to the gateway.

​
Create an identity

1

Navigate to Identities

Open your project in the console and click Identities in the sidebar.
2

Click Create Identity

Click the Create Identity button.
3

Set the name

Enter a descriptive name for this agent — e.g., support-agent, ci-deploy-bot, data-analyst.
4

Add labels (after creation)

Once the identity is created, go to its settings page to add labels. Labels are key-value pairs used in policy evaluation.Common labels:
  • team: support
  • env: production
  • role: agent
  • vendor: anthropic
5

Set allowed tools (optional)

Optionally restrict which tools this identity can see and call. Leave empty to allow all project tools.
6

Generate a credential

Click Generate Credential to create a bearer token for this identity.
The credential secret is displayed only once. Copy it immediately and store it securely. You cannot retrieve it later.
You can optionally set an expiration date on the credential.

​
Using the credential

The agent uses the credential as a bearer token to authenticate with the gateway. MCP clients include it in the Authorization header:

​
Manage credentials

From the identity detail page, you can:
  • Revoke a credential — immediately invalidates it, blocking all requests
  • Generate a new credential — creates a fresh token (the old one stays active until revoked)
  • Set expiration — credentials can auto-expire after a set date
Rotate credentials regularly. Generate a new credential, update your agent configuration, then revoke the old one.

​
Edit labels

Update labels at any time from the identity detail page. Changes take effect within 5 minutes (the identity cache TTL in the gateway).

​
Next steps

Define tasks

Create task definitions for scoped, time-limited access.

Write policies

Author policies that use identity labels for access control.