Introducing Kong Token Vault: Secure, Governed OAuth Authentication for AI Agents

Kong launched Kong Token Vault, integrated into Kong AI Gateway, to give AI agents per-user, three-legged OAuth authentication to upstream services such as GitHub, Figma and Salesforce on behalf of corporate users. Kong Principal Product Manager for Agentic Identity Andrew Jessup said the gateway authenticates callers against the existing corporate identity provider, applies policy, rate limiting and logging before loading any credential, then negotiates a fresh access token from the upstream provider and inserts it into the request so agents never see upstream tokens. Refresh tokens are encrypted with a key held only by the data plane and stored in Kong Identity, with first-time users completing the provider's normal OAuth consent flow via a short-lived enrollment link returned through MCP URL elicitation or a synthetic tool.

Introducing Kong Token Vault: Secure, Governed OAuth Authentication for AI Agents Andrew Jessup Principal Product Manager, Agentic Identity, Kong TL;DR? - AI agents in production require secure access to external services. Kong Token Vault, integrated into Kong AI Gateway, now allows your agents to securely authenticate to external services on behalf of corporate users. - The agents themselves, and the users interacting with them, are identified and governed by your existing corporate identity provider. Access to upstream services is only possible via the Gateway. - All per-use credentials can only be decrypted using a private key available only to the data plane. This content contains a video which can not be displayed in Agent mode You’ve been asked to make a slate of popular services like GitHub, Figma, or Salesforce available as MCP servers to agents inside your organization. Your employees expect to access these through their existing single-sign-on provided by your corporate identity provider. Your security team needs to ensure that any access made by any agent to data inside or outside the company is properly authenticated, authorized, and logged for audit, and that an agent-level kill switch is at the ready in case things go wrong. And all of this needs to be applied scalably across thousands of employees and dozens of external MCP servers and APIs. The catch is that most of those services can’t actually trust your identity provider. A GitHub MCP server, for example, won’t accept your Okta or Entra token. So how do you solve this without resorting to having your agents and users authenticate independently with each and every user using each and every upstream service? To solve this, today we are launching Kong Token Vault with support for per-user, 3 Legged OAuth. Token Vault allows a user and agent to authenticate to an MCP Server proxy using the ordinary OAuth credentials from their corporate identity provider. Access, logging, rate limiting and all other gateway policies are evaluated before any credential is loaded. As needed, the Token Vault will then negotiate for a new access token from the upstream services’ identity provider and transparently insert that token into the request, before it is passed downstream. This allows users to authenticate to existing services, isolates the agent from ever seeing the upstream access tokens, and ensures agents can only interact with critical data sources through an independent, governable pathway. How it works The configuration of the upstream OAuth client for example a GitHub app or a Slack app is configured in a Token Vault Provider. It may be a confidential client using a client ID and secret, a non-confidential client using PKCE, or a Dynamic Client Registration DCR client registered automatically as needed by the Token Vault itself. - On first use, a user's agent calls an MCP server behind Kong AI Gateway. The gateway authenticates the caller and resolves them to a User or Agent principal in Kong Identity. - If no credential exists yet for that principal and provider, the gateway returns a short-lived enrollment link through the MCP response. For agents that support it, the gateway returns this link using MCP URL elicitation. For other agents, the gateway will expose a synthetic tool that returns the URL. - The user then opens the link in their browser and completes the provider's normal OAuth consent flow with the upstream service, normally mapping to the OAuth app specified in the provider. - The gateway exchanges the code with the authorization endpoint defined in the Provider, encrypts the resulting refresh tokens with your key, and sends the envelope to Kong Identity for storage. - The agent retries. From here on, every authorized call gets the credential attached by the gateway. Every call after that is automatic. The gateway authenticates the caller, applies policy, and loads that user’s encrypted credential, or pulls it from a local cache if it was used recently. It decrypts the credential in memory with a private key it reads from your own secrets manager, then injects it into the upstream request. When an access token expires, the gateway refreshes it directly with the provider, re-encrypts the result, and writes it back. The agent gets the response and never the token. Kong Konnect stores the encrypted tokens but holds no key that can open them. And because policy runs first, removing a user’s access takes effect immediately, whether or not their stored credentials have been revoked. Built for scale through self service Providers and the per-user credentials generated for them can be shared between MCP deployments and even between agents, limiting the need for users to perform enrollment multiple times. Users can skip the consent screen altogether using the Token Vault Credential Manager - a self-service console that your AI Gateway hosts for its own users. They sign in with the same corporate identity provider they use everywhere else and connect GitHub, Slack, or Atlassian ahead of time, so their agents start work already connected. The same page lets them disconnect an account they no longer want any agent to use. It never displays a token or key. And because it runs on your gateway rather than in Kong’s cloud, every consent flow it starts ends the same way as any other enrollment: with the authorization code returning to your network. Building in security from day one Token Vault differs from general secrets management solutions like HashiCorp Vault, because it is designed for high cardinality, high-frequency, per-user credential exchanges. A secrets manager also must implicitly trust the party that it hands the secrets to, but with agents that’s the party you trust the least. Token Vault is built to handle the entire token lifecycle, including refreshing, re-encrypting, storing, injecting, auditing and if necessary, revoking, credentials. Users can connect using any identity provider that supports OIDC such as Okta, or Microsoft Entra ID and authenticate transparently to any upstream OAuth-compliant MCP Server and APIs including those from GitHub, Slack, Atlassian Rovo, Google and Datadog. We built Token Vault in consultation with several high-profile enterprise customers - all of whom asked for the ease of use and scalability of the Konnect hosted platform but without the liability of holding large numbers of sensitive credentials in the cloud. As such while Token Vault is managed through Kong Konnect, all of the credentials it uses to negotiate for tokens, as well as the tokens themselves, are encrypted using a private key that is only ever available to the Gateway data planes. This provides the convenience of centralized, hosted management and deep integration along with the security assurances that come from ensuring credentials are not available beyond the corporate network. Token Vault is a complement to other identity translation strategies such as Entra OBO or RFC8963. It is particularly useful in heterogeneous environments where such standards may not be available. Getting started Token Vault is available today as part of the 2.3 release of the Kong AI Gateway and is included with all Kong Gateway subscriptions. To get started, visit Kong.AI https://kong.ai Kong.AI. Traditional applications generally have well-defined boundaries. They interact with a known set of services using credentials provisioned specifically for those connections. Agents are different. Their value comes from their ability to work across s Alex Drag Kong Identity Principals: One Record to Govern Every API, Event, and Application Identity Modern enterprise APIs don't live in one place. They're spread across multiple gateways, deployed across regions and clouds, and accessed by a growing mix of consumers, internal developers, external partners, machine-to-machine services, and increas An AI coding agent is software that writes, tests, and ships code independently. This level of autonomy earlier tools never had. It doesn't wait for you to accept a suggestion line by line. It takes a goal, breaks it into steps, and executes. To do Kong Expanded Observability, Orchestration, and Security with Kong Gateway 3.13 As API ecosystems grow more complex, maintaining visibility and security shouldn't be a hurdle. Kong Gateway 3.13 simplifies these challenges with expanded OpenTelemetry support and more flexible orchestration. These new capabilities not only make y Agent spend grows quietly. Usage shows up as an item line on a shared cloud or model invoice, long after the agents that caused it have run, and most teams cannot tell which team, harness, or app drove it. AI Cost Management solves this with brand Alex Drag AI Agents Need Access to Everything. That Doesn’t Mean They Should Get It. Introducing Kong AI Registry: Governed discovery for enterprise AI models, MCP servers, and agents. Most AI agents today operate with a predefined set of connections. Developers configure which models, MCP servers, tools, and other agents they can Alex Drag Kong Gateway 3.9: Extended AI Support and Enhanced Security Today we're excited to announce Kong Gateway 3.9 Since unveiling Kong Gateway 3.8 at API Summit 2024 just a few months ago, we’ve been busy making important updates and improvements to Kong Gateway. This release introduces new functionality arou Alex Drag Introducing Token Vault: Agents Access Everything. Hold Nothing. Traditional applications generally have well-defined boundaries. They interact with a known set of services using credentials provisioned specifically for those connections. Agents are different. Their value comes from their ability to work across s Alex Drag Kong Identity Principals: One Record to Govern Every API, Event, and Application Identity Modern enterprise APIs don't live in one place. They're spread across multiple gateways, deployed across regions and clouds, and accessed by a growing mix of consumers, internal developers, external partners, machine-to-machine services, and increas An AI coding agent is software that writes, tests, and ships code independently. This level of autonomy earlier tools never had. It doesn't wait for you to accept a suggestion line by line. It takes a goal, breaks it into steps, and executes. To do Kong Expanded Observability, Orchestration, and Security with Kong Gateway 3.13 As API ecosystems grow more complex, maintaining visibility and security shouldn't be a hurdle. Kong Gateway 3.13 simplifies these challenges with expanded OpenTelemetry support and more flexible orchestration. These new capabilities not only make y Agent spend grows quietly. Usage shows up as an item line on a shared cloud or model invoice, long after the agents that caused it have run, and most teams cannot tell which team, harness, or app drove it. AI Cost Management solves this with brand Alex Drag AI Agents Need Access to Everything. That Doesn’t Mean They Should Get It. Introducing Kong AI Registry: Governed discovery for enterprise AI models, MCP servers, and agents. Most AI agents today operate with a predefined set of connections. Developers configure which models, MCP servers, tools, and other agents they can Alex Drag Kong Gateway 3.9: Extended AI Support and Enhanced Security Today we're excited to announce Kong Gateway 3.9 Since unveiling Kong Gateway 3.8 at API Summit 2024 just a few months ago, we’ve been busy making important updates and improvements to Kong Gateway. This release introduces new functionality arou Alex Drag Introducing Token Vault: Agents Access Everything. Hold Nothing. Traditional applications generally have well-defined boundaries. They interact with a known set of services using credentials provisioned specifically for those connections. Agents are different. Their value comes from their ability to work across s Alex Drag Kong Identity Principals: One Record to Govern Every API, Event, and Application Identity Modern enterprise APIs don't live in one place. They're spread across multiple gateways, deployed across regions and clouds, and accessed by a growing mix of consumers, internal developers, external partners, machine-to-machine services, and increas An AI coding agent is software that writes, tests, and ships code independently. This level of autonomy earlier tools never had. It doesn't wait for you to accept a suggestion line by line. It takes a goal, breaks it into steps, and executes. To do Kong Expanded Observability, Orchestration, and Security with Kong Gateway 3.13 As API ecosystems grow more complex, maintaining visibility and security shouldn't be a hurdle. Kong Gateway 3.13 simplifies these challenges with expanded OpenTelemetry support and more flexible orchestration. These new capabilities not only make y Agent spend grows quietly. Usage shows up as an item line on a shared cloud or model invoice, long after the agents that caused it have run, and most teams cannot tell which team, harness, or app drove it. AI Cost Management solves this with brand Alex Drag AI Agents Need Access to Everything. That Doesn’t Mean They Should Get It. Introducing Kong AI Registry: Governed discovery for enterprise AI models, MCP servers, and agents. Most AI agents today operate with a predefined set of connections. Developers configure which models, MCP servers, tools, and other agents they can Alex Drag Kong Gateway 3.9: Extended AI Support and Enhanced Security Today we're excited to announce Kong Gateway 3.9 Since unveiling Kong Gateway 3.8 at API Summit 2024 just a few months ago, we’ve been busy making important updates and improvements to Kong Gateway. This release introduces new functionality arou Alex Drag Ready to see Kong in action? Get a personalized walkthrough of Kong's platform tailored to your architecture, use cases, and scale requirements.