Home / How-to Guides
Edit
Report

Set up a Kong Identity auth server for AI Agent authentication

Uses: Kong Identity AI Gateway Konnect API
Incompatible with
on-prem
Related Documentation
Kong Identity Documentation
In This Series
  1. Set up a Kong Identity auth server for AI Agent authentication
  2. Secure AI Agent traffic with an AI Auth Strategy and Kong Identity
Tags
#ai #a2a #authentication #openid-connect
Related Resources
Kong Identity
AI Auth Strategy entity
Secure AI Agent traffic with OpenID Connect and Kong Identity
TL;DR

Create a Kong Identity auth server, scope, claim, and client. The client issues bearer tokens that an openid-connect AI Auth Strategy can validate to authenticate requests to an AI Agent.

Prerequisites

AI Gateway running

This is a Konnect tutorial and requires a Konnect personal access token.

  1. Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

  2. Export your token to an environment variable:

    export KONNECT_TOKEN='YOUR_KONNECT_PAT'

  3. Run the AI Gateway quickstart script to automatically provision a control plane and data plane in Kong Konnect, and configure your environment:

    curl -Ls https://get.konghq.com/ai | bash -s -- -k $KONNECT_TOKEN

This sets up a AI Gateway control plane named ai-quickstart, provisions a local data plane, and prints out the following environment variables export:

export AI_GATEWAY_ID=your-gateway-id
export KONNECT_TOKEN=$KONNECT_TOKEN
export KONNECT_CONTROL_PLANE_NAME=ai-quickstart
export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
export KONNECT_PROXY_URL='http://localhost:8000'

Copy and paste these into your terminal to configure your session.

Create an auth server in Kong Identity

Before you can authenticate AI Agent traffic, you must first create an auth server in Kong Identity. We recommend creating different auth servers for different environments or subsidiaries. The auth server name is unique per each organization and each Konnect region.

Create an auth server using the /v1/auth-servers endpoint:

_response=$(curl -X POST "https://us.api.konghq.com/v1/auth-servers" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "Kong Air A2A",
       "audience": "http://localhost:8000/a2a",
       "description": "Auth server for authenticating A2A requests to the Kong Air Flight Booking Agent"
     }')

Export the env variables:

export AUTH_SERVER_ID=$(echo "$_response" | jq -r ".id")
export ISSUER_URL=$(echo "$_response" | jq -r ".issuer")

Configure the auth server with a scope

Configure a scope in your auth server using the /v1/auth-servers/$AUTH_SERVER_ID/scopes endpoint:

SCOPE_ID=$(curl -X POST "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/scopes" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "a2a-access",
       "description": "Scope for accessing the Kong Air Flight Booking Agent over A2A",
       "default": false,
       "include_in_metadata": false,
       "enabled": true
     }' | jq -r ".id"
)

Configure the auth server with a custom claim

Configure a custom claim using the /v1/auth-servers/$AUTH_SERVER_ID/claims endpoint:

curl -X POST "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/claims" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "agent",
       "value": "kongair-flight-booking",
       "include_in_token": true,
       "include_in_all_scopes": false,
       "include_in_scopes": [
         "'$SCOPE_ID'"
       ],
       "enabled": true
     }'

You can also configure dynamic custom claims with dynamic claim templating to generate claims during runtime.

Create a client in the auth server

The client is the machine-to-machine credential your AI Consumers use to obtain a bearer token. In this tutorial, Konnect autogenerates the client ID and secret, but you can alternatively specify one yourself.

Configure the client using the /v1/auth-servers/$AUTH_SERVER_ID/clients endpoint:

_response=$(curl -X POST "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/clients" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "Kong Air A2A Client",
       "grant_types": [
         "client_credentials"
       ],
       "allow_all_scopes": false,
       "allow_scopes": [
         "'$SCOPE_ID'"
       ],
       "access_token_duration": 3600,
       "id_token_duration": 3600,
       "response_types": [
         "id_token",
         "token"
       ]
     }')

Export the env variables:

export CLIENT_SECRET=$(echo "$_response" | jq -r ".client_secret")
export CLIENT_ID=$(echo "$_response" | jq -r ".id")

You now have $ISSUER_URL, $CLIENT_ID, and $CLIENT_SECRET for an auth server scoped to the Kong Air Flight Booking Agent. Use these to create an AI Auth Strategy and secure the agent’s A2A traffic.

FAQs

Can I retrieve my client’s secret again?

No, the secret is only shared once when the client is created. Store it securely.

Can I reuse this auth server for other AI Agents, AI Models, or AI MCP Servers?

Yes. Create additional scopes and clients under the same auth server, or reference the same issuer from multiple openid-connect AI Auth Strategies. All AI Models in the same AI Gateway that use OIDC must reference the same AI Auth Strategy, so plan scopes accordingly if you’re authenticating multiple entity types with the same auth server.

Next → 2. Secure AI Agent traffic with an AI Auth Strategy and Kong Identity
Something wrong?
Report an Issue | Edit this Page
View all Kong documentation

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!
Contribute

Still need help?

Ask in our Slack Community
Contact Support