# Deploy an Auth Provider

> Package, deploy, and attach inbound authentication to a Channel safely.

## Before you begin {#before-you-begin}

Choose the inbound authentication protocol and identify any secret material the verifier requires. Store shared signing values or verification keys as Credentials; do not place secret material in the package manifest. You need permission to deploy Auth Providers and read the target Credential references in the namespace.

## Steps {#steps}

1. Implement the Auth Provider contract so it validates the exact inbound bytes and required headers before returning identity evidence.
2. Add a `constal.auth-provider.json` manifest with a stable namespace-local ID, version, entry point, Resource bindings, and Policies.
3. Package the source as ZIP or TAR.GZ, or identify a public HTTPS repository at an immutable commit.
4. Open **Channels → Auth Providers**, choose **Create Auth Provider**, and submit the package source.
5. Wait for build, validation, and immutable deployment to complete. A package that returns malformed authority or requests undeclared capabilities is rejected.
6. Create or update a Channel and select the deployed Auth Provider. Keep the platform-provided **Constal API Key** provider when Constal API keys are the intended caller authentication.

## Verify {#verify}

Send one valid request and one request with missing or invalid proof. The valid request should produce an accepted Channel event with the expected principal and optional customer. The invalid request should fail before Channel execution and must not produce a Run. Confirm that raw keys, signatures, and Credential material do not appear in delivery logs.

## Next steps {#next-steps}

Read [Channel Auth Providers](/docs/channels/auth-providers.md) for the security boundary and [Operate Channels](/docs/channels/operate.md) for delivery inspection. If the Channel needs to call an external service after authentication, configure a separate outbound [Credential](/docs/credentials) and Resource.