OAuth

BETA

Agent Gateway is in BETA, and we're continuing to expand its capabilities. Your feedback helps shape what we build next—reach out to us through Relewise Support.

Agent Gateway supports OAuth 2.0 Authorization Code flow, which requires S256 PKCE. OAuth lets an interactive client access Agent Gateway through the user's My Relewise identity without handling the user's password or a Personal Access Token.

Use OAuth with either the REST API or an MCP client. The client sends the resulting access token as a bearer credential.

Discover the OAuth Configuration

OAuth-compatible clients should discover the configuration from the Agent Gateway resource rather than use hardcoded authorization and token endpoints.

Connection	Protected Resource
REST	https://my.relewise.com/agents
MCP	https://my.relewise.com/agents/mcp

The authorization server issuer is https://my.relewise.com/agents/oauth. Its metadata advertises the supported endpoints, registration options, scopes, grants, and client authentication methods.

Register the Client

Agent Gateway supports three client registration methods:

• Client ID Metadata Document (CIMD): The Client ID is a public HTTPS URL containing the client's metadata. Agent Gateway retrieves and validates the document when the client starts authorization. CIMD clients are public clients and do not use a client secret.
• Dynamic Client Registration (DCR): The client registers through the registration endpoint advertised by the authorization server metadata. The registration response provides its Client ID and, when applicable, a client secret.
• Preregistered client: Relewise registers the client and its redirect URIs in advance. Preregistered clients can be public or authenticate with client_secret_basic or client_secret_post, depending on their configuration.

Use the registration method supported by your client. Most users connecting an existing OAuth-compatible client do not need to perform registration manually.

Request Authorization

OAuth authorization requires:

• The agent_gateway scope.
• Authorization Code flow.
• S256 PKCE.
• The Agent Gateway protected resource for the connection.
• A redirect URI registered for the client.

Request the optional offline_access scope when the client needs a refresh token. The client must also be registered for the refresh_token grant.

The user signs in to My Relewise, reviews the client, and approves or denies the connection. After approval, the client exchanges the authorization code for an access token and sends it in the Authorization header:

Authorization: Bearer <access-token>

Access and Connection Management

OAuth does not bypass Agent Gateway access controls. The user, Connected App, Dataset, Connection Method, and Allowed Area must all permit the requested operation.

See Connected Apps for consent, Dataset access, and connection management. See Security and Permissions for the complete authorization checks.