**TL;DR?**
You’ve been asked to make a slate of popular services like GitHub, Figma, or Salesforce available as MCP servers to agents inside your organization.
Your employees expect to access these through their existing single-sign-on provided by your corporate identity provider. Your security team needs to ensure that any access made by any agent to data inside or outside the company is properly authenticated, authorized, and logged for audit, and that an agent-level kill switch is at the ready in case things go wrong. And all of this needs to be applied scalably across thousands of employees and dozens of external MCP servers and APIs.
The catch is that most of those services can’t actually trust your identity provider. A GitHub MCP server, for example, won’t accept your Okta or Entra token. So how do you solve this without resorting to having your agents and users authenticate independently with each and every user using each and every upstream service?
To solve this, today we are launching **Kong Token Vault **with support for per-user, 3 Legged OAuth. Token Vault allows a user and agent to authenticate to an MCP Server proxy using the ordinary OAuth credentials from their corporate identity provider. Access, logging, rate limiting and all other gateway policies are evaluated before any credential is loaded. As needed, the Token Vault will then negotiate for a new access token from the upstream services’ identity provider and transparently insert that token into the request, before it is passed downstream.
This allows users to authenticate to existing services, isolates the agent from ever seeing the upstream access tokens, and ensures agents can only interact with critical data sources through an independent, governable pathway.
The configuration of the upstream OAuth client (for example a GitHub app or a Slack app) is configured in a Token Vault Provider. It may be a confidential client using a client ID and secret, a non-confidential client using PKCE, or a Dynamic Client Registration (DCR) client registered automatically as needed by the Token Vault itself.
Every call after that is automatic. The gateway authenticates the caller, applies policy, and loads that user’s encrypted credential, or pulls it from a local cache if it was used recently. It decrypts the credential in memory with a private key it reads from your own secrets manager, then injects it into the upstream request. When an access token expires, the gateway refreshes it directly with the provider, re-encrypts the result, and writes it back. The agent gets the response and never the token. Kong Konnect stores the encrypted tokens but holds no key that can open them. And because policy runs first, removing a user’s access takes effect immediately, whether or not their stored credentials have been revoked.
Providers and the per-user credentials generated for them can be shared between MCP deployments and even between agents, limiting the need for users to perform enrollment multiple times.
Users can skip the consent screen altogether using the Token Vault Credential Manager - a self-service console that your AI Gateway hosts for its own users. They sign in with the same corporate identity provider they use everywhere else and connect GitHub, Slack, or Atlassian ahead of time, so their agents start work already connected.
The same page lets them disconnect an account they no longer want any agent to use. It never displays a token or key. And because it runs on your gateway rather than in Kong’s cloud, every consent flow it starts ends the same way as any other enrollment: with the authorization code returning to your network.
Token Vault differs from general secrets management solutions like HashiCorp Vault, because it is designed for high cardinality, high-frequency, per-user credential exchanges. A secrets manager also must implicitly trust the party that it hands the secrets to, but with agents that’s the party you trust the least.
Token Vault is built to handle the entire token lifecycle, including refreshing, re-encrypting, storing, injecting, auditing and if necessary, revoking, credentials. Users can connect using any identity provider that supports OIDC (such as Okta, or Microsoft Entra ID) and authenticate transparently to any upstream OAuth-compliant MCP Server and APIs including those from GitHub, Slack, Atlassian Rovo, Google and Datadog.
We built Token Vault in consultation with several high-profile enterprise customers - all of whom asked for the ease of use and scalability of the Konnect hosted platform but without the liability of holding large numbers of sensitive credentials in the cloud. As such while Token Vault is managed through Kong Konnect, all of the credentials it uses to negotiate for tokens, as well as the tokens themselves, are encrypted using a private key that is only ever available to the Gateway data planes. This provides the convenience of centralized, hosted management and deep integration along with the security assurances that come from ensuring credentials are not available beyond the corporate network.
Token Vault is a complement to other identity translation strategies such as Entra OBO or RFC8963. It is particularly useful in heterogeneous environments where such standards may not be available.
Token Vault is available today as part of the 2.3 release of the Kong AI Gateway and is included with all Kong Gateway subscriptions. To get started, visit [Kong.AI](https://kong.ai)Kong.AI.
Traditional applications generally have well-defined boundaries. They interact with a known set of services using credentials provisioned specifically for those connections. Agents are different. Their value comes from their ability to work across s
Modern enterprise APIs don't live in one place. They're spread across multiple gateways, deployed across regions and clouds, and accessed by a growing mix of consumers, internal developers, external partners, machine-to-machine services, and increas
As API ecosystems grow more complex, maintaining visibility and security shouldn't be a hurdle. Kong Gateway 3.13 simplifies these challenges with expanded OpenTelemetry support and more flexible orchestration. These new capabilities not only make y
Today we're excited to announce Kong Gateway 3.9! Since unveiling Kong Gateway 3.8 at API Summit 2024 just a few months ago, we’ve been busy making important updates and improvements to Kong Gateway. This release introduces new functionality arou
APIs facilitate effortless communication and data exchange between applications and services. However, their inherent design, which codifies service capabilities within the API definition, makes them easily exploitable by malicious actors. API attac
