Put the access token in deps. Leave the client secret in the process that minted it. OPENAI_API_KEY is only for a live agent.run. The sample test does not need it.
The exchange is in Agent frameworks.
Which credential
| Credential | Use it when |
|---|---|
| Agent identity | A named agent inside a project that already has users. Agents is sales-gated until access is approved. |
| M2M application | The caller is a job, or Agents access is not approved yet. Same client_credentials grant. |
| Personal access token | One person's script. Keep it off an unattended caller. |
| Service account | Authdog REST automation. Not the bearer this hook checks. |
To act for a person, keep this hook and present an RFC 8693 token. sub stays the user. act names the agent. The planned sample uses a token whose subject is the agent.
Related
| Read | To learn how to |
|---|---|
| Custom channel auth for Pydantic AI | Refuse a missing bearer |
| Machine identity | Choose the credential |
| Pydantic AI | See the hook |