Set how a credential confirms writes
Each API key and gateway user has a confirmation choice: what happens when its client calls an operation marked as requiring confirmation. For how each choice behaves in the client, see Confirmation.
Before you begin
- At least one operation of an API in the gateway is marked as requiring confirmation. See Mark an operation as requiring confirmation.
Set the choice
To set what a credential does:
- In the portal, go to Agent Gateway and select your gateway.
- Select the Access tab, then API keys or Users, and select the credential.
- In the Confirmation section, select one choice.
- Refuse: the operation is refused and hidden from the client.
- Ask the person: the call waits until the person approves it in the client.
- Ask the agent: the call runs, and the model decides whether to ask first.
- Run without asking: the call runs.
- Select Save changes.
The Confirmation section shows how many operations in the credential's scope are marked. For a user, the change applies to existing sessions on their next call.
Warning
With Run without asking, destructive operations run with nobody asked. Use it only for an automation you supervise.
Which choice to use
| Credential | Choice | Reason |
|---|---|---|
| A user on Claude Code, claude.ai or ChatGPT | Ask the person | These clients can show the confirmation dialog or the confirmation card. |
| A user on a client that cannot ask | Refuse | With Ask the person, every call to a marked operation is refused anyway, and Refuse also hides the operations from the model. |
| A key for an unattended automation | Refuse | Nobody is there to approve. |
| A key for an automation you supervise | Run without asking | The automation is the one that decides. |
Check that the client can ask
After the client has connected once, the credential's page shows a Last client tile with the client's name and can ask: dialog, can ask: card or can ask: no. If the credential is set to Ask the person and the last client cannot ask, the tile says that confirmations are being refused.
See the choice for every credential
The gateway's Policies tab lists every key and user with its choice, under Writes & Idempotency > Operations that require confirmation. The API keys list also shows it next to each key's scopes.
Next steps
- Confirmation: what the person sees in each client.
- Scope a key or user: make a credential read-only instead.
- Logs: find the calls that were refused and why.
Last updated November 11, 2026