Skip to main content

Proxy clients

A Proxy client is a server credential used by the MCP/UCP service to authenticate to AIGW's credential-redemption flow. The Console describes Proxy clients as the credentials a Project uses to authenticate itself to AIGW's proxy endpoint.

Create a Proxy client​

A Project administrator opens Project → Proxy clients → Generate new client. Creating or revoking a Proxy client requires Project Admin permission.

Proxy clients

AIGW displays a client ID and client secret.

The secret is shown only once

Save it directly into your server-side secret manager. It can't be retrieved later; if you lose it, generate a new client and revoke the old one.

Use the credential​

Exchange it for a proxy token using OAuth client_credentials:

POST https://core.api.aigw.loginid.ai/oauth2/token
Authorization: Basic base64(<PROXY_CLIENT_ID>:<PROXY_CLIENT_SECRET>)
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

Use the token response’s expires_in value to determine how long to cache the Proxy token. Obtain a new token before it expires.

Scope and security boundary​

Same Project

The Proxy client belongs to a Project. Credential redemption only works when the proxy token and the user's AIGW access token belong to the same Project.

Server-side only

Never send the Proxy client secret or proxy token to the agent or the browser.

Each Proxy client is listed by client ID and creation time with a Revoke action; revoke the credential if it is compromised or no longer used. A Project can hold several Proxy clients, which allows rotating the backend credential without downtime.

Proxy credential vs management API key​

A Proxy client obtains a runtime bearer for merchant-token retrieval. A console-issued API key authenticates management calls such as /v1/projects; it cannot be substituted for the Proxy token or the user bearer. After you revoke a Proxy client, credential redemption rejects its tokens even if they have not expired.