Resources

A ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. tells AIGW what system or application is being integrated and, critically, what role AIGW should play. Choosing the Resource kind is therefore an architectural choice, not just a ConsoleAIGW ConsoleThe AIGW developer dashboard (DevCon) where you manage Accounts, Projects, Resources, agents, and policies. preference.

Each Resource receives its own AIGW Resource configuration, including a per-resource authorization-server/issuer boundary and signing-key/JWKS information.

Choose the Resource kind

Resource kind	Primary scenario	AIGW's role	Typical developer
Token exchange	Agent acts through MCP/UCP on behalf of a user and ultimately needs access to a merchant API	AIGW handles user/agent authorization and obtains/manages a merchant access token accepted by the merchant's Authorization Server/API	MCP/UCP provider or merchant building an agent-facing service
OAuth client	Traditional human sign-in to an application	AIGW acts as the application's IdP/authorization service and gives the application OAuth/OIDC client configuration	Web/mobile application developer

Simple decision

Building an MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP for agent access? → Token exchange

Adding human sign-in where AIGW is the IdP? → OAuth client

Token exchange Resource

Use Token exchange when the downstream merchant API has its own authorization system and the MCP/UCP service needs a merchant credential representing the authorized user.

Conceptually:

Token exchange: AIGW bridges the agent's authorization to the merchant's own token

The Resource tells AIGW:

• which merchant Resource is being requested;
• which merchant Authorization Server/token endpoint to use;
• which client identity AIGW uses there;
• which authentication/grant mechanism to use;
• which scopes/permissions are relevant;
• which AIGW identity providers may authenticate the human user.

Wizard steps

Step	Fields
1. Identity & endpoint	Resource kind, Display name, Resource indicator / audience, Issuer URL, Token endpoint
2. Authentication	Client ID, Client authentication (private_key_jwt, client_secret_basic — which adds a Client secret field — or token_exchange)
3. Exchange & scopes	Identity providers (optional), Requested scopes (scope value, display name, display description)
4. Reference	Values to hand to the merchant IAM team and the agent developer

Important inputs

Input	Source	Purpose
Resource indicator/audience	Merchant API/IAM owner	Exact downstream Resource identifier. The Console notes it is sent as the resource and must match what the resource expects as its audience; later used during credential redemption
Merchant issuer URL	Merchant OAuth/OIDC metadata	Identifies the merchant Authorization Server (often a different host than the Resource indicator)
Merchant token endpoint	Merchant OAuth/OIDC metadata	Endpoint AIGW calls to obtain/exchange the downstream credential
Client ID	Merchant IAM client registration	Identifies AIGW to the merchant AS
Client authentication	Agreed with merchant IAM	Determines how AIGW authenticates and represents the user
Scopes	Merchant API/IAM	Defines requested downstream permissions

Reference outputs

The Reference step (and the bottom of the Resource's Configuration tab) groups outputs by audience:

Group	Values
For token exchange — hand to whoever verifies subject tokens for this Resource	Expected aud of subject token, client_id AIGW presents, Client authentication, Authorization server (per-resource issuer). Plus Download oauth-protected-resource.json.
For the agent — hand to the agent developer	JWKS URI to verify signature, Discovery endpoint (OIDC), Discovery endpoint (OAuth AS metadata), OAuth2 authorization endpoint (GET, per-resource), OAuth2 token endpoint (POST, core)

Each section has Copy all and per-value copy buttons.

See Configure AIGW for field-by-field setup and current implementation support.

OAuth client Resource

Use OAuth client when a conventional application wants to authenticate a human through AIGW. In this model, AIGW is the IdP/authorization service for the application rather than a bridge to a merchant Authorization Server.

Conceptually:

OAuth client: AIGW is the application's identity provider

Wizard steps

Step	Fields
1. Identity & endpoint	Resource kind, Display name
2. Client configuration	Redirect URIs (one or more), Token endpoint auth method, Allowed scopes
3. Identity providers	Optional selection of Account-enabled IdPs
4. Reference	Client secret (shown once) and the values for the application

Input/choice	What it means	Where it comes from / how to use it
Redirect URIs	Application callbacks allowed to receive the authorization response	Your application; register each exact callback URL (Add redirect URI for more than one)
Token endpoint auth method	How the application authenticates when calling the token endpoint: client_secret_basic, client_secret_post, or none (PKCE)	Use none (PKCE) for public clients (SPA/mobile) and a secret-based method for confidential server-side clients. Shown read-only after creation
Allowed scopes	Identity information/permissions the application may request: openid, profile, email, phone, offline_access	Choose the scopes the application needs (openid is selected by default)
Identity providers	Ways the human may authenticate through AIGW	Select AIGW IdPs appropriate for the application

The Reference step returns the OAuth client information and AIGW endpoints the application needs.

Outputs

AIGW output	What it is	How the application uses it
Client secret, when applicable	OAuth client credential — shown once and can't be retrieved again	Store server-side immediately and use only with the configured client-authentication method
Client ID AIGW issued	OAuth client identifier	Sent in authorization/token requests
Redirect URIs	Echo of the registered callbacks	Confirm they match the application
Agent authorization endpoint	Per-resource /oauth2/auth URL	Start sign-in
Discovery endpoint (OIDC) / Discovery endpoint	Per-resource .well-known/openid-configuration and .well-known/oauth-authorization-server	Discover protocol metadata (including the core token endpoint)
Authorization server	Per-resource AIGW issuer base URL	Configure as the OAuth/OIDC authority

Resource list

ProjectProjectThe isolation boundary for an integration. It holds Resources, agents and agent policy, end users, and Proxy clients. → Resources lists each Resource with its kind badge, status (Active), and a summary: the token endpoint and client authentication for Token exchange ResourcesToken exchange ResourceA Resource for agent access: AIGW authorizes the user and obtains a token from the merchant's own authorization server., or the client ID, redirect URIs, and auth method for OAuth client ResourcesOAuth client ResourceA Resource for ordinary human sign-in, where AIGW acts as the application's identity provider..

Resource settings after creation

A Resource detail page has three tabs:

• Configuration — editable identity, endpoint, client, identity-provider, and scope settings, followed by the Reference values and a Danger zone with Delete resource;
• Signing keysSigning keyA per-Resource ES256 key AIGW uses to sign assertions sent to the merchant authorization server, published at the Resource JWKS URL. — ES256 signing keys/JWKS used for Resource assertions (see Signing keys);
• Sign-in & consent — user-facing branding/consent behavior (see Identity providers).

Current behavior to be aware of:

• The Resource is created when you click Continue on wizard step 3; step 4 displays Reference values. A signing key is generated automatically at the same time.
• A Test exchange button appears on the Reference step and the Configuration tab, but currently produces no visible result.
• Deleting a Resource is permanent: agents using it can no longer exchange tokens for it.