Everything in these docs describes this release only. A production environment and its hosts have not been published yet. When they are, this page will name them and list what changed.
What the labels mean
Label
Meaning
Should you build on it?
Supported
Observed working end to end in this release.
Yes.
Unverified
Implemented, but not yet observed working end to end in this release.
Yes, with a test in your own environment and a fallback.
Planned
Not available in this release.
No. Use the listed alternative.
Unsupported
Visible in the Console or accepted as input, but does not work in this release.
No. Use the listed alternative.
Request flow
Capability
Status
Notes and alternatives
Protected Resource Metadata and 401 challenge
Supported
RFC 9728.
Authorization server discovery
Supported
OpenID Connect and RFC 8414 documents per Resource.
private_key_jwt client authentication. Recorded in an earlier walkthrough; not rerun in the October 17, 2026 recheck, which covered discovery and registration only.
Credential redemption, a Resource you configure
Unverified
Test end to end from the Playground pointed at your Resource before relying on it.
Grant revocation, /api/revoke
Unverified
Documented: drops the user's grant and clears cached merchant credentials. Not covered by a recorded walkthrough.
Refresh token grant
Unverified
If refresh fails, send the user through authorization again.
Client authentication
Method
Status
Notes and alternatives
client_secret_post
Supported
Use for every agent you register.
client_secret_basic
Unsupported
Register with client_secret_post instead.
private_key_jwt (RFC 7523)
Supported
Between AIGW and the merchant's Keycloak in the Playground configuration.
Merchant authorization servers
Setup
Status
Notes and alternatives
Keycloak 26, JWT Authorization Grant (RFC 7523)
Supported
As configured in the Playground.
Keycloak user auto-provisioning
Unverified
Create or link users in Keycloak ahead of time so user mapping succeeds.
Generic OAuth server, RFC 7523
Unverified
Same contract as the Keycloak setup.
Generic OAuth server, RFC 8693 token exchange
Unverified
Prefer RFC 7523 if your server supports both.
Coverage of specific identity providers
Unverified
Only Keycloak has been exercised end to end.
Console
Feature
Status
Notes and alternatives
Accounts, Projects, Resources, Proxy clients
Supported
Agent policy: approve, hold as pending, reject
Supported
New Projects approve all agents by default.
Agent policy: domain rules
Planned
Use approval rules plus manual approve or reject under Agents.
"Test exchange" button on a Resource
Unsupported
Returns no result. Test with a real flow from the Playground.
Custom identity provider, "Connect provider"
Planned
Use a supported provider, or talk to us about yours.
End Users list
Unsupported
Known issue: the list fails to load. Look users up in the merchant's IdP.
Agent proofs
Proof
Status
Notes and alternatives
Web Bot Auth (RFC 9421 signatures)
Unverified
Back it with manual approval under Agents.
Reverse DNS
Unverified
KYA issuers
Unverified
Default minimum trust level is Known.
Disabled KYA issuers in the Console
Planned
Shown but not selectable in this release.
CIMD and platform-trusted
Unverified
Not documented yet
These parts of the contract are not published for this release. Build defensively around them.
Redemption msgCode values other than reauthentication_required.
Token endpoint error bodies. Expect the standard OAuth format.
Rate limits, access token lifetimes and retry guidance.
Signing key rotation schedule.
Self-serve Console sign-up and the Playground source repository link.
