CrewAI

CrewAI keeps its own auth hook. Authdog stays the identity provider. The planned sample attaches an agent access token there and refuses the run when that token is missing or userinfo rejects it.

Sample planned at crewai/python in authdog/agents-samples. That folder is not published yet, so this page does not pin crewai. Python 3.10+.

Channel auth, machine credentials, tool checks, and instructions for this framework are the other pages under CrewAI in AI.

The hook

from crewai.hooks import HookAborted, InterceptionPoint, on

@on(InterceptionPoint.EXECUTION_START)
def require_authdog(ctx) -> None:
    token = ctx.payload.pop("authdog_token", None)
    subject = subject_if_accepted(token)
    if subject is None:
        raise HookAborted(reason="unauthorized", source="authdog")
    ctx.payload["subject"] = subject

Register the hook before kickoff. ctx.payload is the crew inputs. authdog_token is removed before tasks render, so the model does not see the bearer. subject is the id userinfo returned. HookAborted stops the run. The tool does not run.

This is agent identity: client_credentials, then this hook. It is not Agent Sign-In. A browser sign-in does not replace the hook.

What you should see

Kickoff with no token raises HookAborted. No tool result contains a subject.

Kickoff with a bearer userinfo accepts stores that subject and continues. whoami returns it.

pytest in crewai/python is how the sample will prove both. It does not call a model.

Configure

The shared exchange is in Agent frameworks. There is no refresh token. Repeat it before expires_in.

Related