Authdog is the identity provider. The agent framework keeps the auth hook it already has. You register the caller, mint a short-lived bearer, and verify that bearer before the agent, tool, or graph runs.
Use this section when a person is not sitting in a browser session. An agent that signs into your product UI uses Agent Sign-In.
Start here
| You are | Open |
|---|---|
| Letting a coding agent read Authdog docs | Skills |
| Letting that agent change tenants, projects, or users | Use Authdog's MCP server |
| Putting Authdog on an agent framework | The framework group in the sidebar |
| Building the MCP server your users' agents call | Build an MCP server |
| Connecting an MCP client to that server | Connect an MCP client |
One bearer, the framework's hook
Mint the access token once, with client_credentials. Present it on the hook the framework already exposes. The shared exchange, the userinfo result, and what to do after the subject is known are in Agent frameworks.
| Framework | Hook | Guide |
|---|---|---|
| A2A | Agent card, then require_auth on the JSON-RPC mount |
A2A |
| Eve | Channel auth walk: oidc({ issuer, audiences }) |
Eve |
| MCP | token_verifier on your MCP server |
MCP agents |
| LangGraph | require_auth on POST /invoke |
LangGraph |
| OpenAI Agents SDK | Tool RunContext, then require_auth on your API |
OpenAI Agents SDK |
| CrewAI | EXECUTION_START raises HookAborted |
CrewAI |
| Google ADK | before_agent_callback |
Google ADK |
| Pydantic AI | RunContext deps, then require_auth on your API |
Pydantic AI |
| Claude Agent SDK | PreToolUse returns permissionDecision: deny |
Claude Agent SDK |
| Mastra | server.auth.authenticateToken |
Mastra |
| LlamaIndex Workflows | require_auth, then the first workflow step |
LlamaIndex Workflows |
| Semantic Kernel | FUNCTION_INVOCATION filter skips next |
Semantic Kernel |
| Vercel AI SDK | toolsContext, then require_auth on your API |
Vercel AI SDK |
| Strands Agents | BeforeToolCallEvent.cancel_tool |
Strands Agents |
| LangChain | wrap_tool_call does not call the handler |
LangChain |
Each group has the same four follow-ups: the auth boundary, machine credentials, tool checks, and what you put in the prompt. Getting started is the framework page. A page whose sample is still planned says so.
The Agents module is sales-gated. Until access is approved, an M2M application issues the same client_credentials grant.
Three different MCP servers
| Name | What it is |
|---|---|
| Authdog's MCP server | https://api.authdog.com/mcp. Control-plane tools for the signed-in account. |
| Your MCP server | The resource your users' agents call. You verify the bearer. |
| MCP client login | Hosted OAuth so that client can obtain a user token. |
Related
| Read | To learn how to |
|---|---|
| Agent frameworks | Mint the bearer and read the userinfo result |
| Machine identity | Choose M2M, Agents, a service account, or a PAT |
| Agents quickstart | Register an agent and mint the first token |
| AgentSec | See the full agent security story |