Release Notes and Announcements
- Release Notes
- Product Announcement
- Security Advisory
User Guide
Product Introduction
Purchase Guide
- Billing Overview
- Purchase Guide
- WAF Plan Upgrade Method
- Renewing Connections
- Payment Overdue
- Refund
Getting Started
- Getting Started
- FAQs for Beginners
Operation Guide
- Security Overview
- Connection Management
- Security Operations
- Protection Policies
- Service Settings
Practical Tutorial
- WAF CCP Overview
- Bot Management
- API Security
- Integration
- Protection Configuration
API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Asset Management APIs
- Billing APIs
- Protection Settings APIs
- Other APIs
- IP Management APIs
- Integration APIs
- Log Service APIs
- Security Overview APIs
- Rule Engine APIs
- Data Types
- Error Codes
AI Agent Security Gateway
- Release Notes
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- FAQs
- Agreements
- Contact Us
- Glossary
FAQS
- Product Consultation
- Connection
- Usage
- Permissions
- Sandbox Isolation Status
Service Level Agreement
WAF Policy
- Privacy Policy
- Data Processing And Security Agreement
Contact Us
Glossary

Backend Resource Credential Management

Download

Focus Mode

Font Size

Last updated: 2026-10-15 10:15:51

AI-Translated

This document introduces the credential management feature of AI Agent Security Gateway, helping you centrally manage the authentication credentials required for accessing backend resources such as MCP, models, and APIs.
Background Information
You can centrally maintain authentication information through credential management when your MCP, model, or API services require credentials such as keys or tokens to access backend resources. The gateway automatically carries the configured credentials when forwarding requests, eliminating the need to hardcode sensitive information in business code.
Credential management is primarily used for outbound authentication scenarios, where the gateway carries the specified authentication credentials to complete identity verification when initiating calls to MCP, model, or API services.
Operation Step
Adding a Credential
1. Log in to the AI Agent Security Gateway console and choose Authentication Configuration > Credential in the left sidebar.
2. On the Credentials page, click Create a credential.
3. In the Create Credential dialog box, configure the following parameters:
Configuration Item
Description
Secret Name
The name of the custom secret, consisting of up to 64 characters, including Chinese characters, uppercase and lowercase letters, digits, underscores (_), hyphens (-), English parentheses (()), or Chinese parentheses (()).
Authentication Type
Supports the following three types:
API Key: Suitable for backend services that use standard Bearer Token authentication (such as OpenAI-compatible APIs and MCP Servers). You only need to enter the key value (for example, sk-xxxxxxxxxx, up to 256 characters), and you can add multiple keys. You can enable the fault tolerance policy when two or more keys are configured.
Custom Authentication: Suitable for backend services that use non-standard authentication. You can customize one or more request headers to complete authentication, where the key name is the request header name (such as X-Api-Key and apikey) and the key value is the credential content. You can add multiple keys. For standard Authorization: Bearer authentication, we recommend that you use API Key first.
Dynamic Temporary Key: Suitable for scenarios that require dynamic authorization. A temporary access key is generated by a third-party authorization system, and you need to configure the key authorization system (such as Tencent Cloud CAM) and authorized products (such as cls, ims, and tms).
Fault Tolerance Policy
This can be enabled only for the API Key type after at least 2 keys are added. After it is enabled, abnormal circuit breaking and switching are automatically performed among multiple keys. When a key is unavailable, it is automatically avoided to ensure the availability of outbound requests. The following configuration items are included:
Exception Circuit Breaking: You can configure consecutive exception count and isolation duration. When the number of consecutive exceptions reaches the configured threshold, the key is temporarily isolated, and no traffic is assigned to it during the isolation period. If all keys are isolated, calls continue based on the default logic. The default consecutive exception count is 5 (up to 100), and the default isolation duration is 300 seconds (up to 600).
Automatic Switchover: You can configure maximum number of switchovers and timeout duration. When the current request encounters an exception, the gateway switches to another key and resends the request without the caller noticing. The default maximum number of switchovers is 2 (up to 5), and the default timeout duration is 60 seconds (up to 600).
Exception Determination: You can configure status codes that are determined as exceptions. You can select from the dropdown list or directly enter a status code and press Enter to add it. Wildcard expressions are supported (for example, 5xx). The default values are 429 rate limiting and 5xx server errors.
4. After the configuration is complete, click Confirm. The credential is enabled by default after it is created.
Secret Management
On the Credentials list page, you can view, edit, delete, enable, or disable created credentials. The following table describes each field in the list:
Field
Description
Credential Name
Identifying name of the credential.
Credential ID
Unique identifier of the credential.
Authentication Type
Authentication method of the credential, including API Key, custom authentication, and dynamic temporary keys.
Credential Status
Enablement status of the credential. Click the switch to bring the credential online or offline. Credentials associated with MCPs, models, or APIs do not support being brought offline.
Associate MCP Quantity
Number of MCPs associated with the credential.
Associated Model Count
Number of models associated with the credential.
Number of Associated APIs
Number of APIs associated with the credential.
Operation
Edit: Click Edit in the operation column of the target credential, modify parameters such as the credential name and key information, and then save the changes.
Attention:
If you modify authentication information such as key values, the associated MCPs, models, or APIs will fail to be called due to authentication inconsistency. However, modifying only non-authentication settings such as the credential name has no impact. Proceed with caution.
Delete: Click Delete in the operation column of the target credential, and then confirm to remove the credential. Credentials that are associated with MCPs, models, or APIs cannot be deleted.

Help and Support

Was this page helpful?

You can also Contact sales or Submit a Ticket for help.

Help us improve! Rate your documentation experience in 5 mins.

Feedback

Configuration Item	Description
Secret Name	The name of the custom secret, consisting of up to 64 characters, including Chinese characters, uppercase and lowercase letters, digits, underscores (`_`), hyphens (`-`), English parentheses (`()`), or Chinese parentheses (`()`).
Authentication Type	Supports the following three types: API Key: Suitable for backend services that use standard Bearer Token authentication (such as OpenAI-compatible APIs and MCP Servers). You only need to enter the key value (for example, `sk-xxxxxxxxxx`, up to 256 characters), and you can add multiple keys. You can enable the fault tolerance policy when two or more keys are configured. Custom Authentication: Suitable for backend services that use non-standard authentication. You can customize one or more request headers to complete authentication, where the key name is the request header name (such as `X-Api-Key` and `apikey`) and the key value is the credential content. You can add multiple keys. For standard `Authorization: Bearer` authentication, we recommend that you use API Key first. Dynamic Temporary Key: Suitable for scenarios that require dynamic authorization. A temporary access key is generated by a third-party authorization system, and you need to configure the key authorization system (such as Tencent Cloud CAM) and authorized products (such as `cls`, `ims`, and `tms`).
Fault Tolerance Policy	This can be enabled only for the API Key type after at least 2 keys are added. After it is enabled, abnormal circuit breaking and switching are automatically performed among multiple keys. When a key is unavailable, it is automatically avoided to ensure the availability of outbound requests. The following configuration items are included: Exception Circuit Breaking: You can configure consecutive exception count and isolation duration. When the number of consecutive exceptions reaches the configured threshold, the key is temporarily isolated, and no traffic is assigned to it during the isolation period. If all keys are isolated, calls continue based on the default logic. The default consecutive exception count is 5 (up to 100), and the default isolation duration is 300 seconds (up to 600). Automatic Switchover: You can configure maximum number of switchovers and timeout duration. When the current request encounters an exception, the gateway switches to another key and resends the request without the caller noticing. The default maximum number of switchovers is 2 (up to 5), and the default timeout duration is 60 seconds (up to 600). Exception Determination: You can configure status codes that are determined as exceptions. You can select from the dropdown list or directly enter a status code and press Enter to add it. Wildcard expressions are supported (for example, `5xx`). The default values are 429 rate limiting and 5xx server errors.

tencent cloud

Web Application Firewall

Backend Resource Credential Management

Background Information

Operation Step

Adding a Credential

Secret Management

Help and Support

Field	Description
Credential Name	Identifying name of the credential.
Credential ID	Unique identifier of the credential.
Authentication Type	Authentication method of the credential, including API Key, custom authentication, and dynamic temporary keys.
Credential Status	Enablement status of the credential. Click the switch to bring the credential online or offline. Credentials associated with MCPs, models, or APIs do not support being brought offline.
Associate MCP Quantity	Number of MCPs associated with the credential.
Associated Model Count	Number of models associated with the credential.
Number of Associated APIs	Number of APIs associated with the credential.
Operation	Edit: Click Edit in the operation column of the target credential, modify parameters such as the credential name and key information, and then save the changes. Attention: If you modify authentication information such as key values, the associated MCPs, models, or APIs will fail to be called due to authentication inconsistency. However, modifying only non-authentication settings such as the credential name has no impact. Proceed with caution. Delete: Click Delete in the operation column of the target credential, and then confirm to remove the credential. Credentials that are associated with MCPs, models, or APIs cannot be deleted.