Authenticate gateway requests with an external IdP
Enterprise Tier
Requests to a project's gateways authenticate today with a project API key, or carry the caller's own provider credential on the passthrough path. Authenticating a request with a token from an external identity provider (IdP) is planned and is not available in any current release.
Earlier versions of this page walked through configuring a per-project JWT provider: an Authentication tab in the Admin Console, identity-mapping rules, and a dedicated x-tars-idp-token request header. That capability never reached a release, and its design has since been superseded, so the walkthrough is withdrawn rather than left describing a configuration that cannot be reached. Nothing an operator can configure today is missing from this page.
What authenticates a gateway request today
- A project API key on the
Authorizationheader. Keys are issued by developers in the Console and governed organization-wide by operators; issuing, auditing, and revoking them is covered in Onboard developers and issue keys. - The caller's own provider credential, on the passthrough path: the request carries a credential for the upstream provider itself (an Anthropic subscription token, for example), and the gateway forwards rather than substitutes it. The behavior and its routing consequences are covered in Use your own provider credentials and, for the operator-side setup, Enable passthrough for Claude Code.
Single sign-on is a different surface: SSO authenticates people into the consoles, and its identities can then issue API keys. It never authenticates a request to a gateway.
What is planned
Application sign-in with short-lived access tokens: a caller presents a token minted by a trusted issuer in the standard Authorization: Bearer header, issuers are registered per deployment through the management API, and a claim value on the token selects the project. This replaces the withdrawn per-project design above. It is planned for 2026 Q4; the worked configuration, the token contract, and the API surface are published when a release carries them, not before.
Where to go next
Onboard developers and issue keys
The credential that authenticates gateway requests today, from issuance to organization-wide revocation.
Configure SSO
External identity for console sign-in: the surface an external IdP does govern today.
Enable passthrough for Claude Code
The operator setup for requests that carry the caller's own provider credential.
Provision a gateway for a project
The endpoint these credentials authenticate against.