Using Authentication in the NeMo Agent Toolkit

Why it matters

A tool that acts for a user should carry that user’s grant, not a shared administrator key. In this example, the runtime obtains the token and attaches it as an Authorization: Bearer header.

What to practise

Run the demo OAuth provider, register a client with its redirect URI, allowed scopes and client_secret_post, and export NAT_OAUTH_CLIENT_ID and NAT_OAUTH_CLIENT_SECRET. In the workflow config, find the authentication entry of _type: oauth2_auth_code_flow and the who_am_i tool’s auth_provider reference to it. Serve with nat serve, then complete the consent from the Agent Toolkit UI in WebSocket mode. Watch the tool request a bearer token through the provider before it calls /api/me.

How it fits

This is the credential-isolation row of 9.1.1: a named provider with scopes, referenced by the tool. Scopes narrow what the token allows, but the resource server still enforces the grant.