identity: Token Vault reference page

Jobs to be done (optional)

Create a reference page for the Token Vault, the Konnect entity that stores and releases credentials.

Definition of done

• Overview: what is the Token Vault
• Composition: which are the Token Vault components and what are their pupose:
  • Directory
  • Trusted IdP
  • Provider
  • Credentials (stored in the Token Vault)
  • The AI GW role (calls the Token Vault)
• The flows
  - [ ] The required plugins to use the Token Vault:
  - [ ] AI MCP OAuth2 plugin (handles the MCP clinet <--> AI Gateway connections)
  - [ ] MCP AI Proxy plugin (handles the MCP protocol)
• Corporate IdP support table:
  • IdP supports ID-JAG + MCP doesn't: KI: auth servers as trusted authorization server x ID-JAG
  • IdP doesn't support ID-JAG + MCP does: KI auth server as identity issuer (issuer url becomes the ID-JAG iss)
  • IdP + MCP both support ID-JAG: use id-jag-relay plugin and bypass Token Vault entirely
    • Warn about limitations (running through a proxy doesn't allow for protected metadata match the client + lack of ID-JAG negotiation through a trusted intermediary)
• How to enable use the Token Vault
  • From the API
  • From the UI (if up to date)

Information

• PRD
• Updated PRD
• Staging API

Due date (optional)

Size

XL