The Mastra server holds the public key. The caller holds the access token and, if it minted that token, the client secret. There is no refresh token.

The exchange is in [Agent frameworks](/docs/agent-frameworks#mint-the-bearer).

## Which credential

| Credential | Use it when |
| --- | --- |
| Agent identity | A named agent inside a project that already has users. [Agents](/docs/console/agents) is sales-gated until access is approved. |
| M2M application | The caller is a job, or Agents access is not approved yet. Same `client_credentials` grant. |
| Personal access token | One person's script. Keep it off an unattended caller. |
| Service account | Authdog REST automation. Not the bearer this hook checks. |

To act for a person, keep this hook and present an [RFC 8693 token](/guides/agent-delegation). `sub` stays the user. `act` names the agent. The planned sample uses a token whose subject is the agent.

## Related

| Read | To learn how to |
| --- | --- |
| [Custom channel auth for Mastra](/docs/ai/mastra/channel-auth) | Refuse a missing bearer |
| [Machine identity](/docs/machine-identity) | Choose the credential |
| [Mastra](/docs/agent-frameworks/mastra) | See the hook |