Manage Agents

An agent in ThunderID is a distinct class of identity, not a user, not an application, but an autonomous actor that can simultaneously occupy three identity postures:

• Subject: the agent acts on its own behalf, authenticating to systems and invoking tools.
• Actor: the agent carries delegated authority on behalf of a user or another principal; that authority can never exceed what was originally granted.
• Resource: the agent is itself called by other systems or agents, and must authenticate its callers.

ThunderID treats agents as first-class managed identities with a defined lifecycle, an accountable owner, and full audit visibility. They appear under Identities → Agents in the Console.

Each agent has:

• A unique Agent ID generated by ThunderID on creation.
• An owner: the user accountable for the agent's behavior, access, and lifecycle. An unowned agent is an ungoverned agent.
• An optional organization unit that places the agent in the organizational hierarchy.
• An optional OAuth 2.0 configuration that governs how the agent authenticates in each posture.
• A set of custom attributes defined by the agent schema.

Create an Agent

1. Navigate to Agents in the ThunderID Console and click Add Agent.
2. Enter an Agent name. You can type a name or pick one of the generated suggestions.
3. If the agent schema defines required attributes, fill them in on the next step.
4. Select an Owner: the user that will be responsible for this agent.
5. Click Create agent.

After creation, ThunderID displays the agent's Client Secret once. Copy it immediately. It cannot be retrieved again. If you lose it, regenerate a new one from the General tab.

Update an Agent

Open an agent from the Agents list to access its settings. Changes are saved when you click Save in the unsaved-changes bar that appears at the bottom of the page.

The agent name and description are editable inline from the page header.

General

The General tab shows read-only identifiers you can copy for use in your code:

• Agent ID: the unique identifier for this agent within ThunderID.
• Client ID: the OAuth 2.0 client identifier used to request tokens.
• Owner ID: the identifier of the user that owns this agent.

Organization Unit shows which OU the agent belongs to.

The Danger Zone section at the bottom lets you:

• Regenerate Secret: issue a new client secret and immediately invalidate the current one. The new secret is shown once; copy it before closing the dialog.
• Delete: permanently remove the agent.

Attributes

The Attributes tab shows the custom attributes defined by the agent schema. Click Edit to change the values, then click Save.

Flows

The Flows tab is available when the agent has an OAuth 2.0 configuration. It controls:

• Authentication flow: the flow used when the agent initiates a user-facing authentication.
• Registration flow: the flow used for self-service registration.
• Recovery flow: the flow used when a user needs to recover access through this agent.
• Allowed user types: the user types that can authenticate through this agent.

Token

The Token tab controls token issuance settings:

• Access token and ID token validity periods.
• Custom claims added to issued tokens.
• Token signing and encryption options.

Advanced Settings

The Advanced Settings tab configures the OAuth 2.0 protocol settings:

• Grant types: the OAuth 2.0 flows the agent can use (for example, client_credentials, authorization_code, urn:ietf:params:oauth:grant-type:token-exchange).
• Response types: applies to the authorization code flow.
• Token endpoint auth method: how the agent authenticates at the token endpoint (client_secret_basic, client_secret_post, private_key_jwt, or none).
• Public client: marks the agent as a public client (no secret). Forces the token endpoint auth method to none.
• PKCE required: requires PKCE on all authorization code requests.
• Redirect URIs: allowed redirect URIs for authorization code flows.
• Certificate: a public certificate for private_key_jwt authentication or signed/encrypted token verification.

Manage the Agent Schema

The agent schema defines the custom attributes that every agent carries. Click Schema on the Agents list page to open the schema editor.

In the schema editor you can add, edit, or remove attribute definitions. Each attribute has:

• Name: the attribute key.
• Display name: a human-readable label shown in the Console.
• Type: string, number, boolean, array, object, or an enumerated set of string values.
• Required: whether agents must provide this attribute.
• Unique: whether the value must be unique across all agents.
• Credential: marks the attribute as sensitive (hidden in the UI).
• Enum values: allowed values when the type is an enumeration.
• Regex: a validation pattern for string attributes.

Click Save in the unsaved-changes bar to apply the schema changes. The updated schema applies to all agents on their next save.

Delete an Agent

1. Open the agent from the Agents list.
2. Go to the General tab.
3. Click Delete in the Danger Zone section and confirm.

warning

Deleting an agent is permanent. Any active OAuth credentials are revoked. Tokens already issued remain valid until they expire, so keep token lifetimes short for agents you intend to decommission.

Related Guides

• Agent Authentication: Get M2M and OBO tokens using the OAuth 2.0 token endpoint.
• Manage Groups: Add agents to groups to grant scopes and permissions.
• Resource Servers: Configure audience and scope validation on your protected APIs.
• Organization Units: Manage the organizational hierarchy that agents belong to.