does anyone have real world agentic authentication with ContextForge

[chunlongliang-ibm]

This document, https://github.com/IBM/mcp-context-forge/blob/main/docs/docs/manage/sso.md, is more for contextForge admin authentication via browser web sso.
I am looking for agent runtime authentication, where contextForge is between agent and tools (so browser sso does not work). Does ContextForge have JWT or other api authentication path?
If anyone implement the agentic authentication in ContextForge, can you share how does it work?

[lMysticl]

There is now a documented machine-to-machine authentication path for this. It was added in ContextForge 1.0.5.

An agent or service account can obtain an OAuth access token from a trusted external IdP — normally with client_credentials — and send it directly to the API or MCP endpoint:

Authorization: Bearer <access-token>

The required configuration is:

• SSO_API_TOKEN_AUTH_ENABLED=true
• an enabled SSOProvider with trusted_for_api_auth=true
• api_audience set to the audience issued for ContextForge

ContextForge then verifies the token's signature, expiry, issuer, and audience against the provider's JWKS. It accepts access tokens for this flow, not ID tokens.

One detail matters for service accounts: a client_credentials token often has no email claim. In that case ContextForge provisions a synthetic local service principal and resolves its teams/roles through the configured mapping. No browser login or ContextForge-minted API token is required, but a local principal is still part of the authorization model.

See Machine-to-machine API auth with external IdP tokens and the v1.0.5 release.