Manage Agents

An agent in ThunderID is a distinct class of identity, not a user, not an application, but an autonomous actor that can simultaneously occupy three identity postures:

• Subject: the agent acts on its own behalf, authenticating to systems and invoking tools.
• Actor: the agent carries delegated authority on behalf of a user or another principal; that authority can never exceed what was originally granted.
• Resource: the agent is itself called by other systems or agents, and must authenticate its callers.

ThunderID treats agents as first-class managed identities with a defined lifecycle, an accountable owner, and full audit visibility. They appear under Identities → Agents in the Console.

Each agent has:

• A unique Agent ID generated by ThunderID on creation.
• An owner: the user accountable for the agent's behavior, access, and lifecycle. An unowned agent is an ungoverned agent.
• An optional organization unit that places the agent in the organizational hierarchy.
• An optional OAuth 2.0 configuration that governs how the agent authenticates in each posture.
• A set of custom attributes defined by the agent schema.

Create an Agent

1. Navigate to Agents in the ThunderID Console and click Add Agent.
2. Enter an Agent name. You can type a name or pick one of the generated suggestions.
3. If the agent schema defines required attributes, fill them in on the next step.
4. Select an Owner: the user that will be responsible for this agent.
5. Click Create agent.

After creation, ThunderID displays the agent's Client Secret once. Copy it immediately. It cannot be retrieved again. If you lose it, regenerate a new one from the General tab.

Update an Agent

Open an agent from the Agents list to access its settings. Changes are saved when you click Save in the unsaved-changes bar that appears at the bottom of the page.

The agent name and description are editable inline from the page header.

General

The General tab shows read-only identifiers you can copy for use in your code:

• Agent ID: the unique identifier for this agent within ThunderID.
• Client ID: the OAuth 2.0 client identifier used to request tokens.
• Owner ID: the identifier of the user that owns this agent.

Organization Unit shows which OU the agent belongs to.

The Danger Zone section at the bottom lets you:

• Regenerate Secret: issue a new client secret and immediately invalidate the current one. The new secret is shown once; copy it before closing the dialog.
• Delete: permanently remove the agent.

Attributes

The Attributes tab shows the custom attributes defined by the agent schema. Click Edit to change the values, then click Save.

If the agent schema changed since the agent was last saved, saving the agent reconciles its stored attributes with the current schema:

• Values for attributes that were removed from the schema are discarded.
• Values for optional attributes that no longer conform to the schema are discarded.
• Values for required attributes that no longer conform to the schema must be corrected before the save can succeed.

Flows

The Flows tab is available when the agent has an OAuth 2.0 configuration. It controls:

• Authentication flow: the flow used when the agent initiates a user-facing authentication.
• Registration flow: the flow used for self-service registration.
• Recovery flow: the flow used when a user needs to recover access through this agent.
• Allowed user types: the user types that can authenticate through this agent.

Token

The Token tab configures token contents and validity across two sub-tabs:

• User: applies to tokens whose subject is a user the agent acts on behalf of, through the authorization code and on-behalf-of flows. Select the user attributes carried in the access token and ID token, map scopes to claims, select the ID token response format, and set the access token and ID token validity periods. These settings stay frozen until you turn on Delegated mode on the Flows tab.
• Agent: applies to the agent's own access token, issued through the client_credentials grant. Select the claims it carries, its schema attributes, its system attributes (name, owner), OU claims (ouId, ouName, ouHandle), and its groups and roles, and set the token validity period.

Advanced Settings

The Advanced Settings tab configures the OAuth 2.0 protocol settings:

• Grant types: the OAuth 2.0 flows the agent can use (for example, client_credentials, authorization_code, urn:ietf:params:oauth:grant-type:token-exchange).
• Response types: applies to the authorization code flow.
• Client authentication method: how the agent authenticates at ThunderID's client-authenticated endpoints, such as token, introspection, revocation, PAR, and CIBA (client_secret_basic, client_secret_post, private_key_jwt, or none).
• Public client: marks the agent as a public client (no secret). Forces the client authentication method to none.
• PKCE required: requires PKCE on all authorization code requests.
• Redirect URIs: allowed redirect URIs for authorization code flows.
• Certificate: a public certificate for private_key_jwt authentication or signed/encrypted token verification.

Manage the Agent Schema

The agent schema defines the custom attributes that every agent carries. Click Schema on the Agents list page to open the schema editor.

In the schema editor you can add, edit, or remove attribute definitions. Each attribute has:

• Name: the attribute key.
• Display name: a human-readable label shown in the Console.
• Type: string, number, boolean, array, object, or an enumerated set of string values.
• Required: whether agents must provide this attribute.
• Unique: whether the value must be unique across all agents.
• Credential: marks the attribute as sensitive (hidden in the UI).
• Enum values: allowed values when the type is an enumeration.
• Regex: a validation pattern for string attributes.

Click Save in the unsaved-changes bar to apply the schema changes. The updated schema applies to all agents on their next save.

warning

Removing an attribute from the schema does not immediately update existing applications. Any application that lists the removed attribute in its access token, ID token, or userinfo settings continues to return it while agents still hold a stored value. The next time you update and save the application, ThunderID removes the references to attributes that no longer exist in the schema. See Application Settings for the user attributes on the Token tab.

Delete an Agent

1. Open the agent from the Agents list.
2. Go to the General tab.
3. Click Delete in the Danger Zone section and confirm.

warning

Deleting an agent is permanent. Any active OAuth credentials are revoked. Tokens already issued remain valid until they expire, so keep token lifetimes short for agents you intend to decommission.

Related Guides

• Agent Authentication: Get M2M and OBO tokens using the OAuth 2.0 token endpoint.
• Manage Groups: Add agents to groups to grant scopes and permissions.
• Resource Servers: Configure audience and scope validation on your protected APIs.
• Organization Units: Manage the organizational hierarchy that agents belong to.