Glossary
Terms with a dotted underline show a definition on hover or keyboard focus. Press Escape to dismiss a tooltip. Term links lead to a glossary entry or a related guide. You can also browse the definitions below, including on touch screens.
Reading AIGW terminology
AIGW product terms and their relationship to OAuth and identity standards:
| Term in these docs | Meaning and boundary |
|---|---|
| Resource | An AIGW configuration object. Token exchange Resources enable delegated merchant access; OAuth client Resources enable human sign-in to an application. It is not always a downstream API. |
| Token exchange | A Resource kind and configuration label in AIGW. It does not imply that every such Resource uses the RFC 8693 grant: the private_key_jwt pattern uses an RFC 7523 JWT bearer grant. |
| Client authentication | The Resource setup field selects an AIGW request pattern. private_key_jwt and client_secret_basic name authentication methods; token_exchange names a grant pattern. Configure both the grant and authentication expected by the merchant server. |
| Resource indicator | The exact protected-resource identifier used by the integration. It is distinct from the merchant issuer used as an assertion audience, and from an optional RFC 8693 audience request parameter. |
| Proxy client / Proxy token | AIGW names for the service's OAuth client and its client_credentials access token. These are separate from the agent's registration and access token. |
| Credential redemption | The AIGW operation that retrieves a stored merchant access token using both user and service credentials. It is distinct from the merchant-side token grant. |
| Per-resource issuer / Core issuer | Per-resource issuer identifies merchant-facing user assertions and Resource discovery. Core issuer signs agent-facing AIGW tokens; use discovery's core JWKS to validate those tokens. Client assertions use the merchant Client ID as issuer. |
| Platform-trusted | A domain classification maintained by AIGW, rather than a universal identity certification. |
| KYA / Trust level | Know Your Agent describes agent evidence. AIGW uses the configured issuer's evidence and the Trusted / Known / Declared / Unbound / Untrusted classifications; these are not universal authentication assurance levels. |
| acr / amr | acr identifies the authentication context satisfied; its values depend on the provider. amr identifies authentication methods; pop means proof of possession of a key and does not uniquely mean passkey. |
| LID / DevCon / DevAPI / DevCLI | LID means LoginID. DevCon is the AIGW Developer Console, DevAPI is its management API, and DevCLI is the aigw command-line tool. |
| Agent status / Consent | Agent status records operator approval for a Resource. Consent records the user's authorization decision. One does not replace the other. |
For exact issuer, audience, and verification-key choices, see JWTs and JWKS.
Standard references: JWT grants and client authentication, Resource indicators, OAuth token exchange, and registered authentication-method values.
AIGW concepts
AIGW objects, configuration labels, policy classifications, and runtime operations.
- Account
- The top-level AIGW tenant. It owns Projects, team membership, enabled identity providers, billing, and API keys.
- Agent
- The OAuth client acting on a user’s behalf. It discovers AIGW, requests user authorization, and calls the MCP/UCP service with an AIGW access token.
- Agent Callback
- The agent’s registered HTTPS redirect endpoint, which validates the authorization response and exchanges the code using its PKCE verifier.
- Agent policy
- Project or Resource rules that approve, hold for review, or reject an agent when it first requests access to a Resource. Without a configured policy, every agent is approved automatically.
- Agent status
- An agent's Resource grant state, shown within a Project: Pending (requests refused), Approved, Rejected, or Revoked.
- AIGW
- Agent Identity Gateway by LoginID: the identity and authorization layer between AI agents and the services they act on.
- AIGW access token
- The token an agent receives after the user authorizes it. It says which user approved which agent for which scopes.
- AIGW Console
- The AIGW developer dashboard (DevCon) where you manage Accounts, Projects, Resources, agents, and policies.
- AIGW pairwise subject
- An opaque identifier for a user within an AIGW Project. The same person can have different identifiers in different Projects. AIGW can present this value as the merchant-facing assertion’s sub when email-based user matching does not succeed.
- AIGW Token Endpoint
- The OAuth token endpoint hosted by the AIGW core authorization server. Agents exchange authorization codes here; Proxy clients use the client_credentials grant here. Read its URL from discovery’s token_endpoint field.
- Approval rules
- The part of Agent policy that sets Approve, Hold, or Reject for unverified agents and for each kind of agent proof.
- Client authentication
- How an OAuth client proves its identity to the authorization server, for example with a client secret or a signed JWT.
- Core issuer
- The shared AIGW authorization server that issues agent-facing access tokens and hosts the token endpoint.
- Credential redemption
- AIGW’s merchant-token retrieval operation, POST /api/credentials/token, authorized with an AIGW access token and a Proxy token. This operation is distinct from the RFC 8693 exchange that AIGW may perform with a merchant authorization server.
- DevAPI
- The AIGW management API for configuring Accounts, Projects, Resources, credentials, and policies.
- DevCLI
- The aigw command-line tool for managing AIGW Projects, Resources, credentials, and policies from a terminal or coding assistant.
- DevCon
- The AIGW Developer Console: a dashboard for managing Accounts, Projects, Resources, credentials, and policies.
- Domain rules
- Agent policy rules that approve, hold, or reject agents from a specific domain and its subdomains. Checked before approval rules.
- End user
- A person an agent has acted on behalf of at a Project's Resources, as listed in the AIGW Console.
- ext_token:read
- An AIGW authorization scope required for merchant-token retrieval. Request it during user authorization in addition to the Resource scopes needed by the operation; it does not replace the Proxy token.
- KYA issuers
- The Project or Resource list of KYA credential issuers AIGW accepts, each with a minimum trust level. Acceptance is an AIGW policy setting, not an industry-wide certification.
- LID
- LoginID, the provider of AIGW. LID AIGW is the LoginID Agent Identity Gateway; a LID token is an AIGW-issued token.
- login_id
- AIGW’s identifier for a specific authenticated login. Merchant-token storage and retrieval bind to this login as well as the Project, user, and Resource.
- Merchant access token
- A token issued by the merchant's own authorization server. Only the MCP/UCP service sees it, never the agent.
- Merchant Token Endpoint
- The merchant authorization server’s OAuth token endpoint. AIGW uses it to obtain merchant tokens and to refresh them when a refresh token is available.
- Merchant Token Exchange
- The merchant authorization server operation that issues a merchant access token from an AIGW assertion, using the JWT bearer grant or OAuth token exchange configured on the Resource.
- OAuth client Resource
- A Resource for ordinary human sign-in, where AIGW acts as the application's identity provider.
- Per-resource issuer
- The Resource discovery base and merchant user-assertion issuer, at /<RESOURCE_ID> on the AIGW API host. Platform OAuth tokens still use the shared core issuer.
- Platform-trusted
- An AIGW policy classification for a domain on its curated list of agent platforms. It is a product trust decision, not a universal identity or assurance standard.
- Project
- The isolation boundary for an integration. It holds Resources, agents and agent policy, end users, and Proxy clients.
- Prove
- An identity-verification provider available as a built-in AIGW sign-in option. Enable it on the Account, then select it on the Resource.
- Proxy client
- AIGW’s server-side OAuth client for the MCP/UCP service, used with the client_credentials grant. Its ID and secret authenticate the service to AIGW; they are separate from the agent client and merchant-AS client.
- Proxy token
- AIGW’s name for the access token obtained by a Proxy client using client_credentials. The service sends it in X-Proxy-Token alongside the user’s AIGW access token during credential redemption.
- Reference screen
- The last step of Resource registration, listing the values to hand to the merchant IAM team and to agent developers.
- Resource
- An AIGW configuration object inside a Project. A Token exchange Resource represents delegated access to a merchant service; an OAuth client Resource represents an application that uses AIGW for human sign-in.
- Resource indicator
- The exact identifier registered on an AIGW Resource. For MCP, use the canonical MCP endpoint in metadata, OAuth resource parameters, access-token audience validation, and credential redemption. The merchant issuer and downstream merchant API URL are separate values.
- A Resource setting that lets people use accounts across participating merchants. It requires Trust ID and does not replace authorization for access to a merchant Resource.
- Signing key
- A per-Resource ES256 key AIGW uses to sign merchant-facing user and client assertions. The merchant authorization server verifies these signatures using the Resource JWKS.
- Token exchange
- An AIGW Resource kind and merchant-token configuration label. The selected request pattern can use an RFC 7523 JWT bearer grant or an RFC 8693 token exchange; the Resource kind alone does not select the grant.
- Token exchange Resource
- A Resource for agent access: AIGW authorizes the user and obtains a token from the merchant's own authorization server.
- Token Vault
- Where AIGW stores merchant tokens, encrypted and keyed by Project, user, Resource, and login. It refreshes near expiry or requires a new user authorization.
- Trust ID
- An AIGW sign-in option that uses a browser-held key to recognize a returning account and reduce repeated sign-in prompts. Cross-merchant account sharing is a separate option that requires Trust ID.
- Trust level
- The KYA binding classification used by AIGW: Trusted, Known, Declared, Unbound, or Untrusted. These labels describe the credential’s relationship to the presenting agent; they are not universal authentication assurance levels.
- UCP / MCP Proxy
- The service between the agent and merchant API. It validates the AIGW access token, redeems a merchant access token with its Proxy client, and calls the merchant backend.
Standards and general terms
Standards and identity terminology, with the AIGW usage stated where relevant. A general term such as KYA does not by itself specify an interoperable protocol or credential format.
- acr
- Authentication Context Class Reference: the authentication context satisfied for a sign-in. Values such as al2 are defined by the provider and its profile; the label alone does not establish a universal or NIST assurance level.
- amr
- Authentication Methods References: methods used for authentication, such as sms, otp, mfa, or pop. The registered value pop means proof of possession of a key; it is not a passkey-specific value.
- CIMD
- Client ID Metadata Document: an agent uses an HTTPS URL as its client_id and serves its metadata there, so no registration call is needed.
- client_credentials
- An OAuth grant in which a service obtains an access token for itself, without a user authorization code. AIGW Proxy clients use it to obtain Proxy tokens; it does not authorize access on behalf of a user.
- client_secret_basic
- OAuth client authentication using HTTP Basic: the client sends its client ID and secret in the Authorization header of the token request.
- Consent
- The user’s decision to approve or deny requested access. AIGW presents that decision in its consent screen; user consent is separate from operator approval of the agent.
- DCR
- Dynamic Client Registration (RFC 7591): an agent registers itself as an OAuth client at runtime, with no manual setup.
- JWKS
- JSON Web Key Set: a published set of public keys used to verify JWT signatures.
- JWT bearer grant
- RFC 7523: AIGW presents a signed assertion about the user and receives a merchant access token for that user.
- KYA
- Know Your Agent: a general term for evidence about an agent from a credential issuer. In AIGW, accepted issuers and minimum trust levels are configured by policy; KYA alone does not name a single interoperable credential standard.
- MCP
- Model Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server.
- Passkey
- A phishing-resistant FIDO public-key credential offered through the LoginID identity provider. A passkey can be device-bound or synchronized by a credential provider.
- Phone verification
- An AIGW identity-provider flow that verifies control of a phone number and may return additional verified identity attributes. Use the returned evidence and provider context to determine what was established.
- PKCE
- Proof Key for Code Exchange: binds an authorization request to the later code exchange so a stolen code is useless.
- Possession check
- Evidence of control of a phone number or authenticator, such as completing an SMS challenge. It does not by itself establish a person’s legal identity or physical possession of a particular phone.
- private_key_jwt
- OAuth client authentication using a JWT signed with the client’s private key. The authorization server verifies the signature using the client’s registered public key.
- Protected Resource Metadata
- An RFC 9728 document an MCP/UCP service publishes to tell agents which authorization server protects it.
- Reverse DNS
- Forward-confirmed reverse DNS: the agent's IP address resolves to a name in its domain, and that name resolves back to the IP.
- Token exchange (RFC 8693)
- An OAuth grant that trades one token (an AIGW-signed subject token) for another issued by the merchant authorization server.
- UCP
- Universal Commerce Protocol: a standard interface that lets agents carry out commerce tasks with a merchant.
- Web Bot Auth
- An agent signs its HTTP requests (RFC 9421 HTTP Message Signatures) with keys published in its own signature directory.