# auth.md — Cloudanix Agent Registration

This document is for automated agents, CI/CD systems, cloud workloads, and the humans who administer them. Cloudanix agent registration is currently an **administrator-managed provisioning flow**. Cloudanix does not advertise self-service OAuth agent registration metadata or an unauthenticated agent-registration API.

## Registration summary

```yaml
service: Cloudanix
audience:
  - CI/CD pipelines
  - Kubernetes pods and workload identities
  - ECS tasks, Fargate tasks, Lambda functions, and other cloud workloads
  - AI agents and internal automation
registration:
  method: admin_managed_console
  register_uri: https://console.cloudanix.com/
  account_provisioning_uri: https://console.cloudanix.com/users/sign_up
  assisted_provisioning_uri: https://www.cloudanix.com/contact
  requires_tenant_admin: true
  automated_registration: false
credentials:
  type: agent_scoped_token_and_id
  environment_variables:
    - CLOUDANIX_AUTH_TOKEN
    - CLOUDANIX_AGENT_ID
supported_methods:
  account_signup:
    - Google
    - Microsoft
    - email_password
  cloud_auth_modes:
    - Static Principal
    - Static Access Keys
oauth_metadata_available: false
anonymous_agent_registration: false
```

## Who can register an agent

A human Cloudanix tenant administrator registers each Agent in the authenticated Cloudanix console. Registration is intended for organizations connecting their own pipelines, workloads, or agents; it does not create an anonymous public account for the calling agent.

If your organization does not yet have a Cloudanix tenant, use one of these browser-based provisioning paths:

- Create an account: <https://console.cloudanix.com/users/sign_up>
- Request assisted provisioning or a demo: <https://www.cloudanix.com/contact>
- Sign in to an existing tenant: <https://console.cloudanix.com/users/sign_in>

The account signup page supports Google, Microsoft, and email/password registration. These are human account-provisioning methods, not OAuth metadata for autonomous agent registration.

## Register an Agent

1. A tenant administrator signs in at <https://console.cloudanix.com/users/sign_in>.
2. In the authenticated console, the administrator creates an Agent and assigns a name and use case, such as Build Workflow, Cloud Workload, Pod Identity, or another internal/AI agent use case.
3. The administrator sets the maximum session duration and cloud boundary: cloud, account, principal or access-key mode, and the policies the Agent may request.
4. Cloudanix provisions an agent-scoped `CLOUDANIX_AUTH_TOKEN` and `CLOUDANIX_AGENT_ID` for the integration.
5. Store both values in the workload's secret manager and configure the Cloudanix SDK, native CI integration, or tenant-provided raw HTTPS integration instructions.

The currently documented cloud authentication modes are **Static Principal** and **Static Access Keys**. Dynamic Access Keys and Dynamic Role are not listed here because they are not currently advertised as generally available.

## Use credentials

The integration reads both of these values:

- `CLOUDANIX_AUTH_TOKEN` authenticates the Agent's runtime requests to Cloudanix.
- `CLOUDANIX_AGENT_ID` selects the registered Agent boundary and audit identity.

At runtime, the Agent requests elevation with the needed policy and a TTL. Cloudanix checks the request against the administrator-defined boundary. The integration performs the privileged operation and revokes access when the operation completes; the configured maximum TTL is the hard upper bound.

Treat both values as secrets:

- Keep them in a CI/CD, workload, or cloud secret manager; do not commit them to source control.
- Provide them only to Cloudanix SDKs, supported CI integrations, or HTTPS endpoints supplied in your tenant's integration instructions.
- Do not send credentials to the `www.cloudanix.com` marketing site.
- Rotate or revoke credentials from the authenticated console when a workload, repository, or owner changes.
- If a previously working credential is rejected, stop retrying it and ask the tenant administrator to verify or rotate the Agent credentials.

## Supported integrations

Cloudanix documents integrations for Jenkins, GitHub Actions, GitLab CI, Bitbucket Pipelines, CircleCI, ArgoCD, Kubernetes workload identities, ECS/Fargate, Lambda, AI-agent frameworks, and raw HTTPS clients. Availability may depend on your tenant and cloud configuration.

- Agentic JIT overview: <https://www.cloudanix.com/agentic-jit>
- CI/CD provisioning guide: <https://www.cloudanix.com/agentic-jit/build>
- Pod identity guide: <https://www.cloudanix.com/agentic-jit/pod-identity>
- General documentation: <https://www.cloudanix.com/docs/introduction>

## OAuth and automated registration status

Cloudanix does not currently publish the following as supported public discovery interfaces:

- `/.well-known/oauth-protected-resource`
- `/.well-known/oauth-authorization-server`
- ID-JAG registration
- verified-email agent registration
- anonymous agent registration
- a public `/agent/auth` registration endpoint

Do not guess or probe registration endpoints with `POST` requests. Use the browser-based tenant provisioning and administrator-managed Agent registration flow above. This document will be updated if programmatic agent registration becomes available.