Gateway Authentication and Authorization¶
The inference listener resolves a virtual key to its actual Organization, Team, owner and active credential. Effective API access is catalog ∩ Team allowance ∩ key policy. Human management roles do not replace inference policy.
Credentials and lifecycle¶
| Credential | Scope and purpose |
|---|---|
mck_… virtual-key secret |
Actual user membership or ordinary service-account key; current operation/resource policy governs inference/OTLP |
mcc_… client connection |
OAuth credential version of a logical user key; live owner/Team/policy checks remain authoritative |
mcm_… management token |
Expiring, explicitly scoped attenuation of current human administration; control listener only |
| Managed execution proof | Private short-lived turn authority; no reusable Agent key or global secret exposed to callers |
Send an ordinary API credential as Authorization: Bearer <secret>. Never put it in a URL, prompt, tool argument, log or shared Collector configuration. Secret digests and display metadata are retained; one-time reveal does not become an ordinary read API. Rotation retains the logical key and counters. Blocking is reversible, revocation terminal. Expiry, inactive owner/Team or ended membership denies subsequent checks. Rejoining cannot revive the old membership's keys.
Listener matrix¶
Inference and control each bind a separate listener.
| Listener | Route | Authority |
|---|---|---|
| Inference | GET /v1/models |
Current ordinary key policy, or scoped managed proof |
| Inference | POST /v1/chat/completions, POST /v1/responses |
model.generate and authorized virtual model |
| Inference | POST /v1/embeddings, POST /v1/rerank |
model.embed / model.rerank and authorized model |
| Inference | POST /mcp |
Current tool policy; OAuth client connections supported |
| Inference | POST /v1/deployments/{deploymentId}:invoke |
deployment.invoke, allowed deployment and actual API owner grant |
| Inference | GET /.well-known/oauth-protected-resource and /mcp suffix |
Public metadata; no authority granted |
| Collector | OTLP HTTP /v1/traces; OTLP gRPC TraceService/Export |
Actual key telemetry.ingest or dedicated managed capability |
| Control | /management/v1 |
Scoped management token or Console-signed actual user session |
| Control | /internal/*, /healthz, /readyz |
Private infrastructure boundary |
The inference listener must return 404 for private control routes. The control listener must return 404 for inference routes. A management token cannot perform inference; mixed authentication families fail. Ordinary bearer keys may carry only these three public x-mc-* tool controls: x-mc-tools, x-mc-auto-execute, x-mc-max-tool-rounds. They do not grant tool access. Every other x-mc-* service, identity or execution header is rejected rather than interpreted as caller authority. See governed-tool controls.
Private transport¶
Four distinct secrets have separate purposes: INTERNAL_SERVICE_SECRET for Console/Collector signed internal transport, AGENT_RUNTIME_INBOUND_SECRET for runtime inbound envelopes, AGENT_RUNTIME_HEARTBEAT_SECRET for runtime heartbeat, and gateway-only MANAGED_EXECUTION_AUTH_MASTER for derived execution proofs. The runtime receives neither global internal signing authority nor caller API key nor derivation master.
Console transport binds exact method, path/query, body digest, service, timestamp, nonce and actual user_session claims. The gateway rechecks the real session and Organization membership. Managed inference proofs bind a short-lived turn and exact request bytes; a distinct opaque OTLP capability authenticates producer identity. OTLP capability authentication is not body-integrity or replay attestation. Operators and client developers do not construct private proof headers.
Trace, Session and customer attribution¶
Callers may continue valid W3C traceparent/tracestate; otherwise the gateway creates context. X-Mission-Control-Trace-Id and safe correlation headers identify evidence. These identifiers correlate evidence and never authenticate a caller. Correlation is not authority and cannot choose Team, payer, owner or permission.
Direct model/MCP callers may send x-mission-control-session-id under the key's resolved observation namespace, and x-mission-control-customer-subject under its configured customer namespace. Managed public invocation uses customer:{subject} in the body. Required namespaces reject missing subjects; registered-only rejects unknown subjects; verified-person requires the actual authenticated person. A service customer label cannot borrow a person's Connector grant. See namespace setup.
Verification and recovery¶
Make an allowed bounded call, then a forbidden resource call, and inspect canonical Requests. After key block or final membership removal the next call must fail without upstream I/O. A missing/invalid MCP credential returns 401 with OAuth protected-resource metadata in WWW-Authenticate; use the client's sign-in flow. Do not retry paid work merely because telemetry is missing.
See keys, roles, MCP, deployment invocation, OTLP and errors.