Identity provider

Enroll an identity provider with the P0 AI Gateway so its JWT-authenticated agents are trusted to access the gateway.

The Identity provider component enrolls an external identity provider (IdP) with the P0 AI Gateway. Once enrolled, agents that present a JWT issued by that provider are trusted at the gateway, provided the token's claims match the patterns you configure. Use this component to federate the gateway with the issuer that mints your agents' tokens, so those agents can reach the MCP servers behind the gateway.

The Agentic Gateway integration is a preview feature.

Enrolling an identity provider establishes issuer trust: it tells the gateway which token issuers to accept and which audience and subject claims those tokens must carry. When a matching token arrives, P0 resolves it to an individual agent client, either by registering the client automatically or by matching one you pre-registered, depending on the provider's Dynamic registration setting. Enrolling a provider does not, on its own, grant access to any resource. Every accepted request is still authorized against the policies you define in P0.

Prerequisites

• An existing P0 account at p0.app.

• A registered Gateway component, and the gateway deployed in your environment. See Deploying the P0 AI Gateway.

• The details of the issuer whose tokens you want to trust: its issuer URL (the iss claim), and the audience (aud) and subject (sub) claim values its agent tokens carry.

Enroll an identity provider

1. Navigate to Integrations on p0.app and select Agentic gateway, then choose the Identity provider component.

2. Click Add identity provider.

3. Enter the identity provider details, then finish the configuration:

   • Issuer: the issuer URL of the identity provider, matching the iss claim in the tokens it issues. Enter it as a full URL, such as https://your-idp.example.com/. P0 matches this value against the token's iss claim exactly, so it must match the issuer your provider presents character for character.

   • Audience pattern: a pattern that a token's audience (the aud claim) must match to be accepted. A token is accepted when at least one of its audience values matches this pattern.

   • Subject pattern: a pattern that a token's subject (the sub claim) must match to be accepted.

   • Dynamic registration: whether P0 automatically registers agents whose tokens match this provider. Enable it to let P0 register each matching agent as a client the first time it validates the agent's token. Leave it disabled to require that each agent client be pre-registered before P0 accepts its tokens.

4. The identity provider now appears in the component's list of enrolled providers.

Audience pattern and Subject pattern are regular expressions, not literal strings. To match an exact value, anchor the expression, for example ^my-agent$. To accept any value, use .*.

You can enroll more than one identity provider. A token is trusted if it matches any enrolled provider.

Fields

Field	Claim	Matching	Description
Issuer	iss	Exact match	The issuer URL of the identity provider. Must be a valid URL and match the token's iss claim exactly.
Audience pattern	aud	Regular expression	A token is accepted when at least one of its aud values matches this pattern.
Subject pattern	sub	Regular expression	The token's sub claim must match this pattern.
Dynamic registration	—	Toggle	When enabled, P0 registers a matching agent as a client automatically on first validation. When disabled, the agent client must be pre-registered or validation fails.

How it works

When an agent presents a JWT to the gateway, the gateway asks P0 to validate it against the enrolled identity providers. P0 first rejects the token outright if it carries no audience or has a missing, malformed, or expired exp claim. It then looks for an enrolled provider that satisfies all of the following:

• The provider's Issuer equals the token's iss claim.

• At least one of the token's aud values matches the provider's Audience pattern.

• The token's sub claim matches the provider's Subject pattern.

If no enrolled provider matches, the token is rejected. Matching a provider establishes that the token comes from a trusted issuer and carries the expected audience and subject. It is a trust decision about the issuer, not an authorization decision about a specific resource.

Once a token matches a provider, P0 resolves it to an individual agent client, identified by the token's verified email when it carries one, or by its subject otherwise:

• If the client is already registered, P0 accepts the token, unless that client has been disabled.

• If the client is not yet registered, the provider's Dynamic registration setting decides the outcome. With dynamic registration enabled, P0 registers the client automatically and accepts the token. With it disabled, P0 rejects the token until you pre-register the client.

After the token is accepted, the gateway authorizes each tool call against your P0 policies and logs it.

Next steps

• Configure the MCP servers you want to expose behind the gateway.

• Define the Agentic Access Policies that govern what trusted agents can do.