The LangGraph process holds the public key. The caller holds the access token and, if it minted that token, the client secret. POST /invoke expects Authorization: Bearer.
The exchange is in Agent frameworks. This server does not take AUTHDOG_CLIENT_SECRET.
Which credential
| Credential | Use it when |
|---|---|
| Agent identity | A named agent inside a project that already has users. Agents is sales-gated until access is approved. |
| M2M application | The caller is a job or another backend, or Agents access is not approved yet. Same client_credentials grant. |
| Personal access token | One person's script. Keep it off an unattended caller. |
| Service account | Authdog REST automation. Not the bearer require_auth checks here. |
Where each value goes
| Variable | Process | Purpose |
|---|---|---|
PK_AUTHDOG |
The process that serves /invoke |
Authdog(public_key=...). Selects the identity host. |
AUTHDOG_CLIENT_ID / AUTHDOG_CLIENT_SECRET |
The process that calls the token endpoint | Mint the access token. |
| Access token | Authorization header |
What require_auth sends to userinfo. |
There is no refresh token. Repeat the exchange before expires_in. PK_AUTHDOG does not mint tokens. A vault API key is not this bearer.
To act for a person, keep the same route and put an RFC 8693 token in the header. sub stays the user. act names the agent. The sample mints a token whose subject is the agent client.
Related
| Read | To learn how to |
|---|---|
| Custom channel auth for LangGraph | Keep ainvoke behind require_auth |
| Machine identity | Choose the credential |
| LangGraph | Call /invoke and read subject: |
| OpenAI Agents SDK | Present this same token from a tool |