# Create a gateway user

A gateway user is a credential for a person. The person adds the gateway's URL to their client, the client opens the gateway's sign-in page, and they sign in with a username and a password. There is no key to paste. Claude, ChatGPT, Claude Code, Cursor, VS Code and the Faustine CLI connect this way.

A gateway user is not a member of your workspace and cannot open the portal. It belongs to one environment of one gateway.

## Create a user

To create a gateway user:

1. In the portal, go to [**Agent Gateway**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fagent-gateway) and select your gateway.
2. Check the environment button in the header. The user will sign in on the environment it names.
3. Select the **Access** tab, then **Users**, then **New user**.
4. Under **Account**, enter a **Username**. It accepts lowercase letters, digits, dots, dashes and underscores, and is unique in the environment.
5. Under **Password**, keep the generated password or select **Type one** and enter a password of at least 12 characters. Select **Continue**.
6. Under **Scope**, leave **Everything (\*)** or select the operations the user can call. Select **Continue**.
7. Under **Behavior**, choose what happens when the user's client calls an operation that requires confirmation. Select **Ask the person** to have the user approve those calls in their client. A user created here starts on **Refuse**. Select **Continue**.
8. Under **Limits**, set limits lower than the environment's, or leave the fields empty.
9. Select **Create user**.

A dialog shows the username and the password once. Send both to the person, with the gateway's MCP URL from the **Connect** tab.

## How sign-in works

When a client first connects to the MCP URL, it opens the gateway's sign-in page in the browser. After the person signs in, the gateway issues the client a session.

| Property | Value |
| --- | --- |
| Refresh token lifetime | 30 days |
| Failed sign-ins before a lock | 5. The user is locked for 15 minutes. |

Each environment has its own sign-in page and its own users. A client added with the Staging URL signs in as a Staging user, and that session does not work on Production.

## Manage sessions

The user's page lists every session under **Sessions**, with the client, when it was created and when it was last used.

- To sign out one client, revoke its session in the list.
- To sign out every client, select **Revoke all**. The person can sign in again with the same password.

Changes to a user's scope, behavior or limits apply to their existing sessions on the next call.

## Reset the password, lift a lock or revoke

| Action | What it does |
| --- | --- |
| **Reset password** | Sets a new password, shown once, and revokes every session of the user. |
| **Unlock** | Appears while the user is locked after failed sign-ins. Lets them sign in again without waiting. |
| **Revoke** | The user can no longer sign in and every session stops working immediately. It cannot be undone. |

## Next steps

- [Connect clients](https://docs.faustine.ai/agent-gateway/connect-clients/): what the person does in each client.
- [Set how a credential confirms writes](https://docs.faustine.ai/agent-gateway/set-confirmation/): what each confirmation choice does.
- [Scope a key or user](https://docs.faustine.ai/agent-gateway/scope-a-credential/): narrow what the user can call.
- [Set the look and feel of your gateway](https://docs.faustine.ai/agent-gateway/look-and-feel/): put your name and logo on the sign-in page.