Oracle Cloud Infrastructure Documentation

Authentication

Set up inbound authentication to control access to agents and outbound authentication to securely access OCI resources.

Configure authentication on the hosted application. Associated hosted deployments inherit these settings. Choose identity domain bearer token, identity domain browser session, or OCI IAM authentication based on how clients access the application.

Inbound Authentication

Inbound authentication controls who can access your hosted agents. Hosted applications support the following authentication methods:

  • Identity domain bearer token: Clients send an OAuth access token issued by an OCI IAM identity domain. The service validates the token before routing the request to the hosted deployment. See Setting Up Identity Domain Bearer Token Authentication.
  • Identity domain browser session: Uses the OAuth 2.1 Authorization Code flow with Proof Key for Code Exchange (PKCE). Browser users are redirected to an OCI identity domain to sign in. The hosted application service obtains an access token on their behalf and establishes a browser session that uses a session cookie. See Identity domain browser session.
  • OCI IAM: Clients sign requests according to OCI IAM request-signing requirements. See Authentication.

Existing identity domain bearer token and OCI IAM authentication remain supported. To change an application's authentication type, select Edit on the application detail page.

Outbound Authentication

With outbound authentication, deployed agent applications can securely access other OCI resources within a tenancy.

Access is granted by defining OCI IAM policies that authorize the agent application (as a resource principal) to perform specific actions on specified resources. These policies decide the scope of access based on the principle of least privilege.

After deployment, the platform automatically provisions a Resource Principal Session Token (RPST) for the agent workload. The RPST is securely injected into the container runtime, allowing the application to authenticate to OCI services without using long-lived credentials such as API keys or user tokens.

Within the container, the agent uses the OCI SDK with the resource principal authentication provider. The SDK automatically retrieves and refreshes the RPST, enabling secure access to authorized OCI services such as Object Storage, Autonomous AI Database, Vault, and Streaming.