# Channel Auth Providers

> Verify inbound requests and establish trusted principal and customer identity before Channel code runs.

An Auth Provider authenticates traffic arriving through a Channel. It runs before Channel code and returns bounded identity evidence that the platform turns into accepted authority. A Channel refers to one exact Auth Provider; the Channel does not read secrets or decide which tenant, principal, or downstream customer a request belongs to.

## What it establishes {#what-it-establishes}

An Auth Provider can establish a principal and, when the integration supports it, evidence for a downstream customer mapping. Constal validates that mapping within the authenticated parent tenant and pins the resulting authority into the accepted event. Agent code receives the resulting authority context; it cannot replace it with request fields.

**Constal API Key** is the platform-provided default for callers using Constal-issued API keys. Custom providers support protocols such as signed webhooks, external bearer tokens, or another identity system. Public ingress must authenticate successfully before the Channel can normalize or dispatch an event.

## Relationship to Credentials {#relationship-to-credentials}

Auth Providers protect inbound requests. Credential Providers manage secret material used for outbound Resource calls. A webhook verifier may reference a Credential containing its signing secret, but that does not make the Auth Provider a Credential Provider. Keep inbound identity and outbound service authority as separate configurations.

Continue with [Deploy an Auth Provider](/docs/channels/auth-providers/deploy.md), then select it while creating the Channel. Use [Operate Channels](/docs/channels/operate.md) to inspect delivery outcomes without exposing authentication material.