Proxy clients
A Proxy clientProxy clientThe server-side credential (client ID and secret) the MCP/UCP service uses to authenticate itself to AIGW. Never give it to an agent. is the current console name for the server credential used by the MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP service to authenticate to AIGW's credential-redemption flow. The ConsoleAIGW ConsoleThe AIGW developer dashboard (DevCon) where you manage Accounts, Projects, Resources, agents, and policies. describes Proxy clients as the credentials a ProjectProjectThe isolation boundary for an integration. It holds Resources, agents and agent policy, end users, and Proxy clients. uses to authenticate itself to AIGW's proxy endpoint.
Create a Proxy client
Open Project → Proxy clients → Generate new client.
AIGW displays a client ID and client secret.
Save it directly into your server-side secret manager. It can't be retrieved later; if you lose it, generate a new client and revoke the old one.
Use the credential
Exchange it for a proxy tokenProxy tokenA short-lived token the MCP/UCP service gets with its Proxy client, sent as X-Proxy-Token when redeeming a merchant token. using OAuth client_credentials:
POST https://core.api.aigw.eval.loginid.ai/oauth2/token
Authorization: Basic base64(<CLIENT_ID>:<CLIENT_SECRET>)
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials
The supplied run verified a one-hour bearer token (expires_in: 3599).
Scope and security boundary
The Proxy client belongs to a Project. Credential redemptionCredential redemptionPOST /api/credentials/token: the MCP/UCP service trades the user's AIGW token plus its Proxy token for the merchant access token. only works when the proxy token and the user's AIGW token belong to the same Project.
Never send the Proxy client secret or proxy token to the agent or the browser.
Each Proxy client is listed by client ID and creation time with a Revoke action; revoke the credential if it is compromised or no longer used. A Project can hold several Proxy clients, which allows rotating the backend credential without downtime.
