CrewAI keeps its own auth hook. Authdog stays the identity provider. The sample attaches an agent access token there and refuses the run when that token is missing or userinfo rejects it.

Sample: [crewai/python](https://github.com/authdog/agents-samples/tree/main/crewai/python). Python 3.10+. Package `crewai==1.15.28`.

Channel auth, machine credentials, tool checks, and instructions for this framework are the other pages under CrewAI in [AI](/docs/ai/crewai/channel-auth).

## The hook

```python
from crewai.hooks import HookAborted, InterceptionPoint, on

@on(InterceptionPoint.EXECUTION_START)
def require_authdog(ctx) -> None:
    token = ctx.payload.pop("authdog_token", None)
    subject = subject_if_accepted(token)
    if subject is None:
        raise HookAborted(reason="unauthorized", source="authdog")
    ctx.payload["subject"] = subject
```

Register the hook before `kickoff`. `ctx.payload` is the crew inputs. `authdog_token` is removed before tasks render, so the model does not see the bearer. `subject` is the id userinfo returned. `HookAborted` stops the run. The tool does not run.

This is agent identity: `client_credentials`, then this hook. It is not [Agent Sign-In](/docs/agent-sign-in). A browser sign-in does not replace the hook.

## What you should see

Kickoff with no token raises `HookAborted`. No tool result contains a subject.

Kickoff with a bearer userinfo accepts stores that subject and continues. `whoami` returns it.

`pytest` in `crewai/python` checks both. It does not call a model.

## Configure

| Name | Purpose |
| --- | --- |
| `authdog_token` on the kickoff inputs | Access token. The hook removes it before tasks render. The client secret is not an input. |

The shared exchange is in [Agent frameworks](/docs/agent-frameworks#mint-the-bearer). There is no refresh token. Repeat it before `expires_in`.

> **Caution**
>
> Do not commit the client secret, and do not put the access token in the prompt. The public key selects the identity host. It does not mint tokens.

## Related

| Read | To learn how to |
| --- | --- |
| [Agent frameworks](/docs/agent-frameworks) | Mint the bearer this hook checks |
| [Google ADK](/docs/agent-frameworks/adk) | The next hook |
| [Custom channel auth for CrewAI](/docs/ai/crewai/channel-auth) | The same check, as the auth boundary |