Create a gateway user
A gateway user is a credential for a person. The person adds the gateway's URL to their client, the client opens the gateway's sign-in page, and they sign in with a username and a password. There is no key to paste. Claude, ChatGPT, Claude Code, Cursor, VS Code and the Faustine CLI connect this way.
A gateway user is not a member of your workspace and cannot open the portal. It belongs to one environment of one gateway.
Create a user
To create a gateway user:
- In the portal, go to Agent Gateway and select your gateway.
- Check the environment button in the header. The user will sign in on the environment it names.
- Select the Access tab, then Users, then New user.
- Under Account, enter a Username. It accepts lowercase letters, digits, dots, dashes and underscores, and is unique in the environment.
- Under Password, keep the generated password or select Type one and enter a password of at least 12 characters. Select Continue.
- Under Scope, leave Everything (*) or select the operations the user can call. Select Continue.
- Under Behavior, choose what happens when the user's client calls an operation that requires confirmation. Select Ask the person to have the user approve those calls in their client. A user created here starts on Refuse. Select Continue.
- Under Limits, set limits lower than the environment's, or leave the fields empty.
- Select Create user.
A dialog shows the username and the password once. Send both to the person, with the gateway's MCP URL from the Connect tab.
How sign-in works
When a client first connects to the MCP URL, it opens the gateway's sign-in page in the browser. After the person signs in, the gateway issues the client a session.
| Property | Value |
|---|---|
| Refresh token lifetime | 30 days |
| Failed sign-ins before a lock | 5. The user is locked for 15 minutes. |
Each environment has its own sign-in page and its own users. A client added with the Staging URL signs in as a Staging user, and that session does not work on Production.
Manage sessions
The user's page lists every session under Sessions, with the client, when it was created and when it was last used.
- To sign out one client, revoke its session in the list.
- To sign out every client, select Revoke all. The person can sign in again with the same password.
Changes to a user's scope, behavior or limits apply to their existing sessions on the next call.
Reset the password, lift a lock or revoke
| Action | What it does |
|---|---|
| Reset password | Sets a new password, shown once, and revokes every session of the user. |
| Unlock | Appears while the user is locked after failed sign-ins. Lets them sign in again without waiting. |
| Revoke | The user can no longer sign in and every session stops working immediately. It cannot be undone. |
Next steps
- Connect clients: what the person does in each client.
- Set how a credential confirms writes: what each confirmation choice does.
- Scope a key or user: narrow what the user can call.
- Set the look and feel of your gateway: put your name and logo on the sign-in page.
Last updated November 13, 2026