Authorization for AI Connections
Configure authentication and secrets management for your AI connection endpoint.
Overview
The Authentication tab of your AI Connection lets you configure authentication for requests to your AI app endpoint. You pick an Authentication Type, then choose whether its credentials are entered Inline or read from a Secrets Manager.
Secrets Manager
A secrets manager lets you securely retrieve authentication credentials at runtime from a cloud vault, instead of storing them directly on the platform.
To use a secrets manager:
- Select an authentication type
- Switch Credentials from Inline to Key Vault (Azure Key Vault)
- Enter your Vault URL (e.g.,
https://your-vault.vault.azure.net) - Enter your Vault Tenant ID, Vault Client ID, and Vault Client Secret to authenticate to the vault
Authentication
Select an authentication type from the Authentication Type dropdown:
| Type | Description |
|---|---|
| Not set | No authentication is applied (the default) |
| Auth0 | Exchanges client credentials for a Bearer token via Auth0's OAuth2 client credentials flow |
| HMAC | Computes an HMAC-SHA256 signature of the request payload and sends it as a header |
| Azure AD | Gets a Bearer token from Microsoft Entra ID with the client credentials or password (ROPC) grant |
| OAuth2 Client Credentials | Gets a Bearer token from your identity provider's Token URL, authenticating with a client certificate (mTLS) or a client secret |
For a step-by-step Azure AD or Auth0 setup, see Client Credentials AI Connections. WebRTC voice connections get a LiveKit option instead (see Voice).
Auth0 requires the following fields:
| Field | Description |
|---|---|
| Auth0 Domain | Your Auth0 tenant domain (e.g., your-tenant.auth0.com) |
| Audience | The API identifier this token is authorized to access |
| Client ID / Client ID Secret Name | Your Auth0 application client ID, or the name of the secret in your vault if using a secrets manager |
| Client Secret / Client Secret Secret Name | Your Auth0 application client secret, or the name of the secret in your vault if using a secrets manager |
HMAC requires the following fields:
| Field | Description |
|---|---|
| Header Key | The HTTP header name where the signature is sent (e.g., X-Signature) |
| Signature Prefix (optional) | An optional prefix prepended to the signature (e.g., sha256=) |
| Secret Key / Secret Name | The signing key, or the name of the secret in your vault if using a secrets manager |
Next Steps
With authorization configured, your AI connection can securely reach protected endpoints. Next, learn how to handle multi-turn evaluations and link results back to traces.
Multi-Turn State
Persist information across turns during multi-turn simulations.
Linking Traces
Link test cases and turns to their traces for full observability.
Last updated on