Authenticate to Amelfi

Start with a deployed gateway, its control-plane URL, and the authentication method configured by your operator. The console and an MCP client may use different login flows. A console session is not automatically a runtime access token.

Confirm the authentication method

Method	How identity is established
OIDC JWT	The gateway verifies a token from the configured identity provider.
Trusted proxy	An approved proxy authenticates the request and supplies normalized identity.
Local identity	The gateway verifies a local account and manages its session.
Local header bootstrap	Development-only identity headers in a controlled environment.

For production, use the deployment’s configured identity flow. Do not copy identity headers from a local development example into a public deployment.

Verify an API identity

For a deployment using bearer-token authentication, set the control-plane origin and obtain a valid token through the configured identity provider. The example assumes the token is already available in your process environment as AMELFI_TOKEN.

export AMELFI_CONTROL_PLANE="https://gateway.example.com"
curl --fail-with-body "$AMELFI_CONTROL_PLANE/v1/identity/me" \
  -H "Authorization: Bearer $AMELFI_TOKEN"

Check the returned actor and permissions. A valid token with insufficient permissions is an authorization problem; a rejected token is an authentication problem. Keep token material out of screenshots and shared logs.

Check scope before making changes

Confirm that the console is showing the intended environment. For self-hosted deployments, scope is supplied by the backend configuration. Administrative role bindings govern changes to gateway resources; runtime Cedar policy governs tool calls.

Continue with your first governed call.

Implementation reference

Read the source contract.