Skip to main content

Authorization

AIGW uses OAuth Authorization Code with PKCEPKCEProof Key for Code Exchange: binds an authorization request to the later code exchange so a stolen code is useless. for the agent/user authorization flow.

Authorization endpoint​

https://api.aigw.eval.loginid.ai/<RESOURCE_ID>/oauth2/auth

Example​

?response_type=code
&client_id=<AGENT_CLIENT_ID>
&redirect_uri=https://agent.example.com/callback
&scope=openid%20search:read
&state=<STATE>
&code_challenge=<S256_CHALLENGE>
&code_challenge_method=S256

The end userEnd userA person an agent has acted on behalf of at a Project's Resources, as listed in the AIGW Console. authenticates using a Resource-enabled identity provider and then sees the consent UI. On approval, AIGW redirects to the agent's registered callback with an authorization code.

Controls that can affect authorization​

  • Agent status at the ProjectProjectThe isolation boundary for an integration. It holds Resources, agents and agent policy, end users, and Proxy clients. level (set by Agent policy or a person's decision);
  • requested scopes configured on the ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays.;
  • enabled identity providers;
  • end-user authentication outcome;
  • end-user consent/denial.

Use S256 rather than plain even though plain appeared in the observed discovery metadata.