Eve verifies a JWT. It does not call userinfo, and it does not read the client secret. You mint an Authdog access token somewhere else, then send it as `Authorization: Bearer` on `POST /eve/v1/session`.

The exchange is in [Agent frameworks](/docs/agent-frameworks#mint-the-bearer). Agent access tokens for the environment are JWTs. An opaque token fails `oidc()`.

## Which credential

| Credential | Use it when |
| --- | --- |
| Agent identity | A named agent. The [Agents](/docs/console/agents) module is sales-gated until access is approved. |
| M2M application | A backend or job, or Agents access is not approved yet. Same `client_credentials` grant, and the access token is still a JWT. |
| Personal access token | One person's script. Keep it off the Eve process. |
| Service account | Authdog REST automation. Not the bearer Eve's channel verifies. |

## Where each value goes

| Variable | Process | Purpose |
| --- | --- | --- |
| `AUTHDOG_CLIENT_ID` / `AUTHDOG_CLIENT_SECRET` | The process that calls the token endpoint | Mint the JWT. Eve never reads these. |
| `AUTHDOG_ISSUER` | Eve | Environment issuer, `https://<identity-host>/oidc/<environmentId>`. Must match the token's `iss`. |
| `AUTHDOG_AUDIENCE` | Eve | Must match the token's `aud`. |
| Access token | `Authorization` header on the session request | What `oidc()` verifies. |

There is no refresh token. Repeat the exchange before `expires_in`. `npx eve dev` listens on port 2000 unless `PORT` is set.

`PK_AUTHDOG` is not an Eve setting. Eve discovers signing keys from the issuer document. Putting the client secret in the Eve environment does not help `oidc()`, and it puts the secret next to the agent.

## Acting for a person

Send an [RFC 8693 token](/guides/agent-delegation) in the same header. Eve still checks signature, issuer, expiry, and audience. `sub` on that token is the user, and `act` names the agent. The sample path mints a `client_credentials` token whose subject is the agent client.

## Related

| Read | To learn how to |
| --- | --- |
| [Custom channel auth for Eve](/docs/ai/eve/channel-auth) | Mount `oidc()` as the only authenticator |
| [Machine identity](/docs/machine-identity) | Choose the credential that mints the JWT |
| [Eve](/docs/agent-frameworks/eve) | See the `401` when the bearer is missing |
| [Agent delegation](/guides/agent-delegation) | Keep the user as `sub` |