Loading Gatelion
GatelionDocs
Open the console

Set up customer access

This page takes you through setting up customer access, from registering Gatelion with your login provider to the policy that decides what customers' agents may do. You need to be an admin of your Gatelion organization. Allow about 30 minutes, plus the time to set up a login provider if you don't have one.

1. Register Gatelion with your login provider

Gatelion sends your customers to your own login to sign in, so it needs to be registered there as an application.

  1. Copy the callback address. In the console, open Customer access. Under Your customers' login, copy the callback address. It's your organization's own and ends in /oauth/callback/<your organization id>.
  2. Create an application at your login provider, of the kind for a regular web application (server-side, using the authorization code flow).
  3. Add the callback address as an allowed callback (redirect) address.
  4. Allow the scopes openid profile email.
  5. Note the issuer, the client id and the client secret. The issuer is your provider's base address, such as https://login.example.com. Your provider publishes its settings at that address plus /.well-known/openid-configuration.

Gatelion uses the code flow with PKCE, so a client secret is optional if your provider doesn't issue one. When a customer confirms an action, Gatelion asks your login for a fresh sign-in (prompt=login with a max_age of 5 minutes), and checks the auth_time in the ID token. Make sure your provider honors these; most do.

2. Fill in your login settings

On Customer access → Your customers' login:

FieldWhat to enter
IssuerThe issuer from step 1.
Name your customers know you byShown to customers on the sign-in, consent and confirmation pages, for example Skyline Air.
Client idFrom step 1.
Client secretFrom step 1, if your provider gave one. It's stored encrypted and never shown again; leave the field empty later to keep it.
ScopesLeave openid profile email unless your provider needs more. Must include openid.
New agentsWait for your approval before customers can use them (recommended), or Can be used at once; you can block any later.

Choose Save login settings on the bar that appears at the bottom of the page, then Test the settings. Gatelion reads your provider's published settings and tells you where customers will sign in and how many signing keys it found. If something's wrong, you see it now instead of when a customer tries.

With Wait for your approval, each new agent appears under Agents and customers → Agents on Customer access when it first connects. Customers can't use it until you choose Approve. Check the name, website and contact it gave: the agent chose them itself, and Gatelion doesn't check them.

Both lists there, the agents and the customers who let one act for them, show 25 a page; choose up to 200 under Per page. Search the agents by name, website or contact, and filter them by status. Search the customers by email, name or agent, and show only permissions still allowed or withdrawn.

3. Add a hosted Gateway for customers' agents

On Gateways → Add Gateway, choose:

  • Where it runs: Hosted by Gatelion
  • Which agents connect: Your customers' agents, after the customer signs in

Gatelion sets it up; it shows Being set up by Gatelion… for a moment. Then its MCP address, ending in /g/<gateway id>/mcp, appears on Gateways and on Customer access. That's the address you give to agent makers, or publish for your customers.

A hosted Gateway can reach only addresses on the public internet. Your API must be reachable from there.

4. Connect your API

Under Tools & agents → Connections → Add connection:

  1. Called by: choose the Gateway from step 3 (marked hosted by Gatelion).
  2. Address and sign-in: enter your API's address and its key, token or other sign-in. The value is sealed in your browser for the hosted Gateway: Gatelion's servers store only the encrypted value, and it's never shown back. If you change the connection's sign-in later, enter the secret again.
  3. Import API description on the new connection: choose An OpenAPI file or Paste OpenAPI, or Describe the operations if your API has no OpenAPI description. Check the preview, and import it.
  4. Add tools under Tools, choosing only the operations customers' agents should be able to use.
  5. Turn on Tell it who each call is for on the connection, so your API receives the signed X-Gatelion-Identity header with every call. See Verify the identity header.

More detail on connections is in Connect a system.

5. Write the policy

Policies work exactly as for your own agents: ordered rules, first match wins, anything not matched is denied. What's new is who approves. On a rule whose Then is Needs approval, choose Who confirms:

Who confirmsIn JSONWho must approve
Your approvers (the default)staffAn approver in your organization, as for your own agents.
The customer (outside agents)customerThe customer the agent acts for, on their confirmation page. Your staff can't decide it.
BothbothThe customer and one of your approvers, in either order. A "no" from either one rejects it.

For example, for a flight-booking portal, as it shows in the editor's JSON tab:

JSON
{"rules":[
  {"id":"search","match":{"tools":["skyline.flights.search","skyline.bookings.list"]},"effect":"allow"},
  {"id":"book","match":{"tools":["skyline.bookings.create"]},"effect":"require_approval","approvers":"customer"},
  {"id":"refund-large","match":{"tools":["skyline.refunds.create"],"args":[{"path":"amount","op":"gt","value":500}]},"effect":"require_approval","approvers":"both"},
  {"id":"refund","match":{"tools":["skyline.refunds.create"]},"effect":"require_approval","approvers":"customer"}
]}

Things to know:

  • Rules with no agents chosen apply to every agent, including each customer's agent. The card shows Any agent. That's usually what you want.
  • To single out one agent, choose it under Agents. Customers' agents are listed there, named as they registered followed by a short code in brackets, and marked "your customers' agent". The rule keeps the agent's id, so an agent that registers again is a new agent, and you choose it again.
  • Customer rules don't work for your own agents. If one of your own agents matches a rule with customer or both, the call is denied with customer_confirmation_unavailable: there's no customer to ask.
  • No email goes to your approvers for requests only the customer decides. With both, your approvers are notified as usual.

See Write a policy and Policy format.

Block agents and withdraw permissions

Under Agents and customers, Customer access lists, per Gateway, every agent that registered and every customer who allowed an agent to act for them.

ToDo thisEffect
Stop an agent for everyoneBlock it under Agents, then Block agent to confirmNew sign-ins are refused at once. Calls stop after the Gateway's next sync. Customers' permissions for it stop working until you approve it again.
Let a waiting or blocked agent inApprove itCustomers can sign in and allow it.
Stop one agent acting for one customerWithdraw under Customers who let an agent act for them, then Withdraw permission to confirmThe agent can't renew its sign-in, and its calls are refused after the Gateway's next sync. Requests still waiting for that customer's confirmation can no longer be confirmed. This can't be undone: the customer would have to connect the agent again and allow it.

A Gateway syncs about every 15 seconds, so a block or withdrawal takes effect within about that time, not instantly. A call that already started finishes.

Customers can also withdraw a permission themselves, on their own page. Its address is on Customer access, under Your customers' page; link to it from your site, for example from your account settings. The consent page shows it too. See What your customers see.

To stop a whole Gateway for customers' agents, stop it on Gateways. To remove it for good, stop it and then Retire it there: its MCP address stops working, requests waiting for approval through it are cancelled, its connections' tools are switched off, and it no longer shows on Customer access. See Retire a Gateway.

Try it

Connect an MCP client that supports MCP sign-in to the Gateway's MCP address and sign in as a test customer. What your customers see walks through it with Claude Code.

Related: Your customers' agents · Verify the identity header

Still stuck? Contact support from the console.