Deploy an Auth Provider

Package, deploy, and attach inbound authentication to a Channel safely.

Before you begin

Choose the inbound authentication protocol and identify any secret material the verifier requires. Store shared signing values or verification keys as Credentials; do not place secret material in the package manifest. You need permission to deploy Auth Providers and read the target Credential references in the namespace.

Steps

1. Implement the Auth Provider contract so it validates the exact inbound bytes and required headers before returning identity evidence.
2. Add a constal.auth-provider.json manifest with a stable namespace-local ID, version, entry point, Resource bindings, and Policies.
3. Package the source as ZIP or TAR.GZ, or identify a public HTTPS repository at an immutable commit.
4. Open Channels → Auth Providers, choose Create Auth Provider, and submit the package source.
5. Wait for build, validation, and immutable deployment to complete. A package that returns malformed authority or requests undeclared capabilities is rejected.
6. Create or update a Channel and select the deployed Auth Provider. Keep the platform-provided Constal API Key provider when Constal API keys are the intended caller authentication.

Verify

Send one valid request and one request with missing or invalid proof. The valid request should produce an accepted Channel event with the expected principal and optional customer. The invalid request should fail before Channel execution and must not produce a Run. Confirm that raw keys, signatures, and Credential material do not appear in delivery logs.

Next steps

Read Channel Auth Providers for the security boundary and Operate Channels for delivery inspection. If the Channel needs to call an external service after authentication, configure a separate outbound Credential and Resource.