# Endpoint and authentication

Agent Mission Control developer docs > Bring your own agent

> How AMC builds request URLs from your endpoint, the two credentials it can present, and what multi-tenancy means for your service.

**Before you start:** A deployed endpoint. Managed identity also needs a Tenant Admin and an app registration in Microsoft Entra ID.

## The endpoint URL

The **Endpoint URL** is a base. AMC adds a trailing slash if it's missing and resolves every path relative to it, so an endpoint of `https://invoices.contoso.com/amc` gets `https://invoices.contoso.com/amc/health`, `https://invoices.contoso.com/amc/runs`, and so on.

- It must be an absolute `http` or `https` URL. Use `https` anywhere but local testing; managed identity requires it.
- Path segments don't change these URLs. They only form the resource id AMC sends as `orchestratorWorkflowId`. See [the resource id](https://www.agentmissioncontrol.ai/developers/register-your-agent/).
- The health check does not follow redirects. Serve `/health` directly.

## API key

In key mode AMC presents the key in an `api-key` header on every call, including `/health`. It never sends the key as `Authorization: Bearer`, and never sends both headers.

`What your endpoint receives`
```http
POST /amc/runs HTTP/1.1
Host: invoices.contoso.com
api-key: <your-agent-api-key>
Content-Type: application/json; charset=utf-8
```

`Check the key (FastAPI)`
```python
import os

from fastapi import Depends, FastAPI, Header, HTTPException

API_KEY = os.environ["AGENT_API_KEY"]


def check_key(api_key: str | None = Header(default=None, alias="api-key")) -> None:
    if api_key != API_KEY:
        raise HTTPException(status_code=401, detail="unauthorized")


app = FastAPI(dependencies=[Depends(check_key)])
```

- Return `401` or `403` for a bad key. At registration that shows as **Access not granted**, which tells the person the endpoint is up and the key is wrong.
- AMC stores the key in Key Vault, never returns it, and deletes it when the registration is deactivated.
- To rotate, update the registration with the new key. AMC checks the new key against `/health` before it replaces the stored one, so accept both keys while you switch.

## Managed identity

In managed-identity mode AMC requests a Microsoft Entra token from its own managed identity for the **Resource scope** you register, and presents it as `Authorization: Bearer <token>`. Your service validates it like any Entra access token issued for your app.

1. Create an app registration for your endpoint and give it an application ID URI, for example `api://invoice-summarizer`.
2. Have your AMC administrator approve your host and that audience for the installation (below).
3. Register as a Tenant Admin (or Super Admin) with **Managed Identity (same tenant)** and **Resource scope** set to `api://invoice-summarizer/.default`.
4. In your service, accept tokens for that audience from AMC's identity, and reject everything else with `401`.

AMC's identity is shared by the whole installation, so it refuses to send a token anywhere it wasn't told to. A custom-endpoint registration with managed identity must pass every rule, or registration fails before anything is stored:

| Rule | If it fails |
| --- | --- |
| The caller is a Tenant Admin or Super Admin. | `403` with reason `managed_identity_requires_tenant_admin`. |
| The scope is an application ID URI (`api://...`). Azure resource scopes and a blank scope are refused. | `400`: AMC does not send tokens for Azure resource scopes to self-hosted endpoints. |
| The endpoint is `https`. | `400`: managed identity is only sent to https endpoints. |
| The host, or a parent domain of it, is approved for the installation, and the scope is one of that host's approved audiences. | `400`: managed identity isn't set up for that host, or the audience isn't approved for it. |

The approvals live in one installation setting, `Registration:SelfHostedManagedIdentityTargets`, in the form `host=audience[,audience...][;host=...]`. A host entry admits that host and its subdomains, never look-alikes. Empty, the default, means managed identity is off for custom endpoints.

`Registration:SelfHostedManagedIdentityTargets`
```text
agents.contoso.com=api://invoice-summarizer/.default;tools.contoso.com=api://tool-a/.default,api://tool-b/.default
```

## Tenancy

- AMC is multi-tenant. Each AMC tenant registers your endpoint separately, and each registration has its own credential and its own runs.
- AMC sends no tenant identifier on calls to your endpoint. A managed-identity token is the same for every tenant on an installation, so it can't tell them apart.
- If one endpoint serves several AMC tenants, give each registration its own API key and map key to tenant on your side. Never let one tenant's run id resolve for another.
- Your agent's own outbound credentials (to your model provider, to the systems it reads) are yours to manage. AMC never sees them.

> **Important:** If an AMC background worker can't resolve the registration's credential, it polls your endpoint without one rather than poll a different endpoint. An endpoint that enforces auth returns `401`, which AMC records as a poll failure on the right endpoint. Never answer an unauthenticated poll with run data.

## Related

- [Bring your own agent](https://www.agentmissioncontrol.ai/developers/byo-overview/)
- [Register your agent: the technical reference](https://www.agentmissioncontrol.ai/developers/register-your-agent/)
- [Errors and timeouts](https://www.agentmissioncontrol.ai/developers/byo-errors-and-timeouts/)

---
Source: https://www.agentmissioncontrol.ai/developers/byo-endpoint-and-auth/ · Last updated 2026-10-21 · Full index: https://www.agentmissioncontrol.ai/llms.txt