Skip to main content

Security

AI Gateway is client-facing: AI agents connect inbound to it, over Streamable HTTP, to reach upstream MCP servers and HTTP APIs. That's the primary connection to secure here, the opposite of Kafka Gateway's security surface, which secures the outbound connection Kafka Gateway makes to your Kafka brokers.

This section covers both:

  • Bearer: authenticate AI agents at the gateway with JWT Bearer, before any tool call reaches an upstream MCP server or HTTP API.
  • TLS: encrypt the inbound connection from AI agents, optionally with mutual TLS client certificate verification.

Bearer and TLS are independent and commonly combined: Bearer authenticates the agent, TLS encrypts the inbound connection that carries the request.