> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devctrl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Identities

> Create agent identities with credentials, labels, and optional tool restrictions.

An identity represents an AI agent in your project. Create one for each agent (or agent instance) that will connect to the gateway.

## Create an identity

<Steps>
  <Step title="Navigate to Identities">
    Open your project in the console and click **Identities** in the sidebar.
  </Step>

  <Step title="Click Create Identity">
    Click the **Create Identity** button.
  </Step>

  <Step title="Set the name">
    Enter a descriptive name for this agent — e.g., `support-agent`, `ci-deploy-bot`, `data-analyst`.
  </Step>

  <Step title="Add labels (after creation)">
    Once the identity is created, go to its **settings page** to add labels. Labels are key-value pairs used in policy evaluation.

    Common labels:

    * `team: support`
    * `env: production`
    * `role: agent`
    * `vendor: anthropic`
  </Step>

  <Step title="Set allowed tools (optional)">
    Optionally restrict which tools this identity can see and call. Leave empty to allow all project tools.

    | Setting        | Behavior                  |
    | -------------- | ------------------------- |
    | Not set        | Can see all tools         |
    | Specific tools | Can only see listed tools |
  </Step>

  <Step title="Generate a credential">
    Click **Generate Credential** to create a bearer token for this identity.

    <Warning>
      The credential secret is displayed only once. Copy it immediately and store it securely. You cannot retrieve it later.
    </Warning>

    You can optionally set an **expiration date** on the credential.
  </Step>
</Steps>

## Using the credential

The agent uses the credential as a bearer token to authenticate with the gateway. MCP clients include it in the `Authorization` header:

```
Authorization: Bearer dc_live_a1b2c3d4...
```

## Manage credentials

From the identity detail page, you can:

* **Revoke** a credential — immediately invalidates it, blocking all requests
* **Generate a new credential** — creates a fresh token (the old one stays active until revoked)
* **Set expiration** — credentials can auto-expire after a set date

<Tip>
  Rotate credentials regularly. Generate a new credential, update your agent configuration, then revoke the old one.
</Tip>

## Edit labels

Update labels at any time from the identity detail page. Changes take effect within 5 minutes (the identity cache TTL in the gateway).

## Next steps

<CardGroup cols={2}>
  <Card title="Define tasks" icon="list-check" href="/console/define-tasks">
    Create task definitions for scoped, time-limited access.
  </Card>

  <Card title="Write policies" icon="pencil" href="/console/write-policies">
    Author policies that use identity labels for access control.
  </Card>
</CardGroup>