Authdog is the identity provider. The agent framework keeps the auth hook it already has. You register the caller, mint a short-lived bearer, and verify that bearer before the agent, tool, or graph runs.

Use this section when a person is not sitting in a browser session. An agent that signs into your product UI uses [Agent Sign-In](/docs/agent-sign-in).

## Start here

| You are | Open |
| --- | --- |
| Letting a coding agent read Authdog docs | [Skills](/docs/ai/skills) |
| Letting that agent change tenants, projects, or users | [Use Authdog's MCP server](/docs/ai/mcp-server) |
| Putting Authdog on an agent framework | The framework group in the sidebar |
| Building the MCP server your users' agents call | [Build an MCP server](/docs/ai/mcp-development/build-server) |
| Connecting an MCP client to that server | [Connect an MCP client](/docs/ai/mcp-development/connect-client) |

## One bearer, the framework's hook

Mint the access token once, with `client_credentials`. Present it on the hook the framework already exposes. The shared exchange, the userinfo result, and what to do after the subject is known are in [Agent frameworks](/docs/agent-frameworks).

| Framework | Hook | Guide |
| --- | --- | --- |
| A2A | Agent card, then `require_auth` on the JSON-RPC mount | [A2A](/docs/agent-frameworks/a2a) |
| Eve | Channel `auth` walk: `oidc({ issuer, audiences })` | [Eve](/docs/agent-frameworks/eve) |
| MCP | `token_verifier` on your MCP server | [MCP agents](/docs/agent-frameworks/mcp) |
| LangGraph | `require_auth` on `POST /invoke` | [LangGraph](/docs/agent-frameworks/langgraph) |
| OpenAI Agents SDK | Tool `RunContext`, then `require_auth` on your API | [OpenAI Agents SDK](/docs/agent-frameworks/openai-agents) |
| CrewAI | `EXECUTION_START` raises `HookAborted` | [CrewAI](/docs/agent-frameworks/crewai) |
| Google ADK | `before_agent_callback` | [Google ADK](/docs/agent-frameworks/adk) |
| Pydantic AI | `RunContext` deps, then `require_auth` on your API | [Pydantic AI](/docs/agent-frameworks/pydantic-ai) |
| Claude Agent SDK | `PreToolUse` returns `permissionDecision: deny` | [Claude Agent SDK](/docs/agent-frameworks/claude-agent) |
| Mastra | `server.auth.authenticateToken` | [Mastra](/docs/agent-frameworks/mastra) |
| LlamaIndex Workflows | `require_auth`, then the first workflow step | [LlamaIndex Workflows](/docs/agent-frameworks/llamaindex) |
| Semantic Kernel | `FUNCTION_INVOCATION` filter skips `next` | [Semantic Kernel](/docs/agent-frameworks/semantic-kernel) |
| Vercel AI SDK | `toolsContext`, then `require_auth` on your API | [Vercel AI SDK](/docs/agent-frameworks/ai-sdk) |
| Strands Agents | `BeforeToolCallEvent.cancel_tool` | [Strands Agents](/docs/agent-frameworks/strands) |
| LangChain | `wrap_tool_call` does not call the handler | [LangChain](/docs/agent-frameworks/langchain) |

Each group has the same four follow-ups: the auth boundary, machine credentials, tool checks, and what you put in the prompt. Getting started is the framework page. A page whose sample is still planned says so.

The Agents module is sales-gated. Until access is approved, an [M2M application](/docs/machine-identity) issues the same `client_credentials` grant.

## Three different MCP servers

| Name | What it is |
| --- | --- |
| Authdog's MCP server | `https://api.authdog.com/mcp`. Control-plane tools for the signed-in account. |
| Your MCP server | The resource your users' agents call. You verify the bearer. |
| MCP client login | Hosted OAuth so that client can obtain a user token. |

## Related

| Read | To learn how to |
| --- | --- |
| [Agent frameworks](/docs/agent-frameworks) | Mint the bearer and read the userinfo result |
| [Machine identity](/docs/machine-identity) | Choose M2M, Agents, a service account, or a PAT |
| [Agents quickstart](/docs/quickstarts/agents) | Register an agent and mint the first token |
| [AgentSec](/docs/agentsec) | See the full agent security story |