> For the complete documentation index, see [llms.txt](https://docs.steadybit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.steadybit.com/install-and-configure/install-on-prem-platform/advanced-agent-authentication.md).

# Advanced Agent Authentication

## Agent Authentication using an Agent Key

By default, agents authenticate using the configured agent key.\
This key is global: every agent in your organization uses the same one.

{% hint style="warning" %}
In case your agent key got compromised and you need to rotate the agent key, contact our [support](https://steadybit.com/contact).
{% endhint %}

## Agent Authentication using [OpenID Connect](https://openid.net/connect/)

If you want to have more security controls, you can use OIDC for the agent authentication instead of the agent key. This requires an OIDC identity provider (e.g. Keycloak).

For each request to the platform, the agent uses an access token issued by the identity provider. The platform verifies the token.

### Platform Configuration

To instruct the platform to validate all incoming agent requests against a specific identity provider, set `STEADYBIT_AUTH_AGENT_PROVIDER=OAUTH2` and the `STEADYBIT_AUTH_AGENT_OAUTH2_ISSUER_URI` to the issuer URI of your identity provider.

All options are described in [Platform Configuration Options](/install-and-configure/install-on-prem-platform/advanced-configuration.md#openid-connect-authentication).

### Agent Configuration

To tell the agent to use OIDC, set `STEADYBIT_AGENT_AUTH_PROVIDER=OAUTH2`, `STEADYBIT_AGENT_AUTH_OAUTH2_ISSUER_URI` to the issuer URI of your identity provider and the `STEADYBIT_AGENT_AUTH_OAUTH2_CLIENT_ID` to the client ID to use.\
Alternatively, instead of using the issuer URI, you can configure `STEADYBIT_AGENT_AUTH_OAUTH2_TOKEN_URI` directly to tell the agents where to get the access tokens from. In that case the OIDC discovery endpoint is not read.

All options are described in [Agent Configuration Options](/install-and-configure/install-agent/advanced-configuration.md).

#### Using client credentials flow

To use the client credentials flow you need to set the `STEADYBIT_AGENT_AUTH_OAUTH2_CLIENT_SECRET` to the client secret.

#### Using password flow (with credentials or mutual TLS)

To use a username and password, set `STEADYBIT_AGENT_AUTH_OAUTH2_AUTHORIZATION_GRANT_TYPE=password` and provide a username and password with `STEADYBIT_AGENT_AUTH_OAUTH2_USERNAME` and `STEADYBIT_AGENT_AUTH_OAUTH2_PASSWORD`.

To use mutual TLS, specify PEM files containing an X.509 certificate and a PKCS#8 private key by setting `STEADYBIT_AGENT_AUTH_OAUTH2_CLIENT_CERT_KEY_FILE` and `STEADYBIT_AGENT_AUTH_OAUTH2_CLIENT_CERT_CHAIN_FILE`. In case the key is encrypted you can specify the password using `STEADYBIT_AGENT_AUTH_OAUTH2_CLIENT_CERT_PASSWORD`.\
The agent reloads the certificates automatically when the file changes, but this might take up to ten seconds.