> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity

> The Identity screen — Auth credentials and Roles for a gateway, managed in the NeuralTrust console.

**Identity** (`Agent Gateway` → **Identity**) is where you manage credentials and
identity-based access for the selected gateway. It has two tabs: **Auth** and **Roles**.

## Auth tab

Create reusable auth **entities**, then attach them to [consumers](/trustgate/concepts/consumers).

| Type      | Label in UI | Typical use                                                               |
| --------- | ----------- | ------------------------------------------------------------------------- |
| `api_key` | **API Key** | Static `ag_…` keys for LLM consumers.                                     |
| `oauth2`  | **OAuth2**  | Interactive login (IdP discovery or manual URLs) or M2M token validation. |
| `oidc`    | **OIDC**    | JWT validation (JWKS / public keys) for LLM and identity-based routing.   |

### Create an auth entity

1. Open **Identity** → **Auth** → **New Auth**.
2. Choose the type and fill issuer / JWKS / client / key fields as prompted.
3. For **API Key**, generate the key and set expiry (**Never**, 30 days, 90 days, 1 year).
   Copy the secret once.
4. Save. Attach the entity from a consumer **Auth** tab or during consumer create.

### OAuth2 setup modes (UI)

| Mode                                          | When                                              |
| --------------------------------------------- | ------------------------------------------------- |
| **Validate tokens only (M2M)**                | Services present bearer tokens; no browser login. |
| **Interactive login · IdP with discovery**    | Browser/agent login; OpenID discovery.            |
| **Interactive login · IdP without discovery** | Manual authorize / token / userinfo URLs.         |

OIDC fields include issuer, JWKS URL, audiences, required scopes, allowed algorithms,
subject claim, and optional public keys / certificate constraints.

Full IdP walkthroughs: [Authorization](/trustgate/concepts/authorization/overview),
[Okta](/trustgate/concepts/authorization/okta),
[Entra ID](/trustgate/concepts/authorization/entra-id).

### Consumer attachment

| Consumer protocol | Auth methods in UI                                                                                                              |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **LLM**           | API Key, OAuth2, OIDC                                                                                                           |
| **MCP**           | **OAuth2** (and **Use NeuralTrust** built-in login as the default empty binding). API keys are not the MCP path in the console. |

Consumers can also create API keys on their own **Auth** tab (LLM). See
[Auth](/trustgate/concepts/auth).

## Roles tab

Roles power **Identity-based** consumer routing.

1. Open **Identity** → **Roles** → **New Role**.
2. Set **Claim** and **Value** (for example `groups` = `engineering`).
3. **Add Registry** — grant LLM and/or MCP registries.
4. Optionally **restrict models** or **tools** (or leave all permitted).
5. On a consumer, set **Routing mode** → **Identity-based** and select the role(s). Ensure
   the consumer uses an OIDC (or OAuth2) credential whose tokens carry matching claims.

Details: [Roles](/trustgate/concepts/roles).

## Related

* [Consumers](/trustgate/concepts/consumers) — attach auth and choose routing mode.
* [MCP](/trustgate/mcp/overview) — agent OAuth on the MCP plane.