Ingress Auth Providers

Verify inbound requests and establish trusted principal and customer identity before Channel or UI code runs.

An Auth Provider authenticates traffic arriving through a Channel or authenticated UI. It runs before Channel or UI code and returns bounded identity evidence that the platform turns into accepted authority. Each ingress Resource refers to one exact Auth Provider revision; authored code does not read secrets or decide which tenant, principal, or downstream customer a request belongs to.

What it establishes

An Auth Provider can establish a principal and, when the integration supports it, evidence for a downstream customer mapping. Constal validates that mapping within the authenticated parent tenant and pins the resulting authority into the accepted event. Agent code receives the resulting authority context; it cannot replace it with request fields.

Constal API Key is the platform-provided default for callers using Constal-issued API keys. Custom providers support protocols such as signed webhooks, external bearer tokens, or another identity system. The provider receives the exact shared ingress target { kind: "channel" | "ui", crn }; authenticated ingress must succeed before Channel normalization, UI execution, or Agent dispatch.

Relationship to Credentials

Auth Providers protect inbound requests. Credential Providers manage secret material used for outbound Resource calls. A webhook verifier may reference a Credential containing its signing secret, but that does not make the Auth Provider a Credential Provider. Keep inbound identity and outbound service authority as separate configurations.

Continue with Deploy an Auth Provider, then select its exact revision while creating a Channel or authenticated Dynamic UI. Use Operate Channels to inspect delivery outcomes without exposing authentication material.