Security

AI Gateway is client-facing: AI agents connect inbound to it, over Streamable HTTP, to reach upstream MCP servers and HTTP APIs, and applications connect inbound through the OpenAI and Anthropic APIs to reach LLM providers. That's the primary connection to secure here, the opposite of Kafka Gateway's security surface, which secures the outbound connection Kafka Gateway makes to your Kafka brokers. AI Gateway also makes its own outbound calls, to the upstream MCP servers, HTTP APIs, and LLM providers behind it, which is a separate auth concern from authenticating the inbound caller.

This section covers both:

• LLM Credentials: check the API key each application sends to the LLM Gateway, forward each caller's own provider key, restrict models by role, and sign AWS Bedrock requests.
• Bearer: authenticate AI agents at the gateway with JWT Bearer, before any tool call reaches an upstream MCP server or HTTP API, and authenticate Zilla's own outbound calls to an upstream with Client Credentials or Token Exchange.
• TLS: encrypt the inbound connection from AI agents, optionally with mutual TLS client certificate verification and per-role authorization by certificate identity, and connect to LLM providers over TLS, including model servers with a private certificate authority.

Bearer and TLS are independent and commonly combined: Bearer authenticates the agent, TLS encrypts the inbound connection that carries the request.