AI agents

An AI agent in Strivacity is an OAuth2/OIDC client with the AI agent client subtype. The agent authenticates to Strivacity with its client credentials, and the client ID is the agent's identity: it's what appears in account events, authorization consent records, and the My Account portal when the agent acts on a customer's account.

There are two ways an agent becomes a client.

• A brand admin registers it manually, as this page describes: the right fit for agents that are part of your brand systems or need bespoke configuration.
• External agents operated by your customers can instead identify themselves by presenting a Client ID Metadata Document. See Dynamic clients.

Creating an AI agent

Like other client types, agents belong to an Application, and they authorize customers using that Application's journeys and policies. You can start from the Agentic AI area or from the Application:

• Agentic AI > AI agents > Create asks you to pick the Application first, then offers the two AI agent client types.
• An Application's Clients tab > Create shows the full client type catalog, where the AI agent variants appear as choices.

Either way, choose between:

• OIDC using no-code components (AI agent): the standard choice. The agent redirects the customer to Strivacity's hosted login and consent pages.
• OIDC using the Journey Flow API (native, AI agent): for agents that render the login experience natively via the Journey Flow API.

After you pick a type, the normal client creation form opens with the Client subtype preset to AI agent.

1. Give the client a Name and a Description. The name identifies the agent to admins.
2. Work through the tabs described below: the agent's public identity on Application launcher, its protocol settings on OAuth2/OIDC, and its token settings under Advanced.
3. Select Save.

Configuration

The sections below follow the client editor's tabs and call out the settings that matter for agents. The rest behave as they do for any client; see OAuth2/OIDC properties setup for the full reference.

General

Basic properties: the Name and Description that identify the agent to admins, the Enabled toggle, and an optional Base organization if the agent should be scoped to an organization.

AI agent clients carry one more setting here than other clients: the Dynamic client template switch, off by default. Turning it on at creation makes the client a template for dynamic clients instead of a client that authenticates itself, and transforms the rest of the form. The designation is permanent once the client is saved, in both directions. See Dynamic clients.

Deleting an agent (from the Danger zone on this tab) permanently removes the client, and with it the agent's ability to authenticate.

Application launcher

The Display name and Logo URL are the identity your customers see on consent screens and in the My Account portal, so use the agent's public name and logo.

OAuth2/OIDC

The OAuth2/OIDC tab holds the protocol configuration:

• Client ID and Client secret are generated when the client is created. The agent's operator needs both, along with your instance's discovery endpoint.
• Token endpoint authentication method: how the agent authenticates to the token endpoint. Basic is the default; agents that can't hold a secret can use None, and agents with their own key pair can use JWT.
• Allowed callback URLs: the agent's redirect URIs. Strivacity matches these exactly, per OAuth2 best practice.
• Protected resources: assign one or more protected resource policies. This is the allowlist of Model Context Protocol (MCP) servers and APIs the agent may request tokens for; an authorization request naming any other resource is rejected. A client can't have two assigned resources with the same resource URL.
• Require consent for scopes: when enabled, customers are prompted to consent before their data (claims) is shared with the agent. Claim consent appears on the same consent page as the scope consents.
• Dialect: the claim dialect that determines which claims the agent receives.

Assigning protected resources isn't specific to agents; any OAuth2/OIDC client can be assigned them. What's specific to the AI agent subtype is audience handling: token audiences are constructed automatically from the assigned protected resources, so there's no custom audience configuration on an AI agent client. The requested resource value is matched exactly against the assigned resource URLs, and the matched URL becomes the token's audience. Generic clients keep their custom audience settings alongside any assigned resources.

Configuring authorization consents per resource

The protected resource defines the catalog of scopes it supports; the client controls what this agent may do with them. For each assigned resource, you configure per scope:

• Whether the agent is allowed to request the scope at all. An agent doesn't have to request everything it's allowed; step-up-only scopes are typically allowed here but left out of the agent's initial request.
• Whether the consent is required: a required consent can't be unchecked by the customer on the consent screen, while an optional one can.
• Whether the consent is shown to the customer or granted automatically. Automatically granted consents don't appear in the consent list; use this when you'd rather describe the access in your own words in the consent screen text than rely on the built-in list.

Advanced

Token settings live under Advanced on the client:

• Access token lifespan and Access token format (Opaque or JWT). Tokens for MCP servers and APIs should be JWT so the resource can validate them locally.
• Enable refresh tokens, with Refresh token lifespan and optional refresh limits.

Managing agents

Agentic AI > AI agents lists every AI agent client across all your Applications, with its logo, name, client ID, and Application. Selecting an agent opens the same client editor you'd reach through the Application.

The list's Registration column distinguishes Manual and Template entries, with a matching filter. Template rows open the template editor. Agents using Client ID Metadata Documents don't appear in the list at all, since no client record exists for them; their footprint is in authorization consents and account events. See Dynamic clients.

Where to go next

• Protected resources: register what the agent gets access to.
• Authorization consents: the consent experience and how customers revoke access.