`Caller.token` is an access token. It is not the client secret. The process that calls the token endpoint holds the secret, puts the access token in the environment the agent reads, and leaves the secret out of `Runner.run`.

The exchange is in [Agent frameworks](/docs/agent-frameworks#mint-the-bearer).

## Which credential

| Credential | Use it when |
| --- | --- |
| Agent identity | A named agent. [Agents](/docs/console/agents) is sales-gated until access is approved. |
| M2M application | A job or backend, or Agents access is not approved yet. Same `client_credentials` grant. |
| Personal access token | One person's script. Keep it out of `Caller` on an unattended agent. |
| Service account | Authdog REST automation. Not what `/whoami` verifies. |

## Where each value goes

| Variable | Process | Purpose |
| --- | --- | --- |
| `AUTHDOG_CLIENT_ID` / `AUTHDOG_CLIENT_SECRET` | Minting process | Token endpoint. Not `Caller`. |
| `AUTHDOG_ACCESS_TOKEN` | Agent | `Caller(token=...)`. |
| `WHOAMI_URL` | Agent | Absolute URL of `GET /whoami`. |
| `PK_AUTHDOG` | API | `require_auth`. |
| `OPENAI_API_KEY` | Agent | Only for `Runner.run`. Proving the tool attaches the header does not need a model. |

There is no refresh token. Replace `AUTHDOG_ACCESS_TOKEN` before `expires_in`. Putting the client secret in `Caller` or in the agent instructions sends it to the model and to your API as if it were a bearer. The API will reject it. The model will have seen it.

To act for a person, keep this route and this tool. Put an [RFC 8693 token](/guides/agent-delegation) in `Caller.token` so `sub` stays the user and `act` names the agent.

## Related

| Read | To learn how to |
| --- | --- |
| [Custom channel auth for the OpenAI Agents SDK](/docs/ai/openai-agents/channel-auth) | See the tool attach the header |
| [Machine identity](/docs/machine-identity) | Choose the credential that mints the token |
| [Agents quickstart](/docs/quickstarts/agents) | Register the client |
| [OpenAI Agents SDK](/docs/agent-frameworks/openai-agents) | Run `GET /whoami` |