> ## Documentation Index
> Fetch the complete documentation index at: https://agno-v2.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

> JWT validation and scope-based permissions for AgentOS endpoints.

AgentOS validates the JWT on every request, then checks its scopes against the permissions each endpoint requires. This controls who can access and run your agents, teams, and workflows.

![JWT verification flow](https://mintcdn.com/agno-v2/OKeW7yILLWZLffpy/images/jwt-verification-light.png?fit=max\&auto=format\&n=OKeW7yILLWZLffpy\&q=85\&s=b88c395ee42102aced0c7a15789fd619)

Enable authorization when initializing AgentOS:

```python theme={null}
from agno.agent import Agent
from agno.models.openai import OpenAIResponses
from agno.os import AgentOS


agent = Agent(
    id="my-agent",
    model=OpenAIResponses(id="gpt-5.2"),
)

agent_os = AgentOS(
    id="my-agent-os",
    agents=[agent],
    authorization=True,
)

app = agent_os.get_app()
```

## Key Concepts

| Concept | Description |
| - | - |
| Tokens | JWTs signed by the control plane or your own backend, sent as `Authorization: Bearer <token>` |
| Scopes | Permission strings in the `scopes` claim, like `agents:read` or `agents:my-agent:run` |
| Roles | Named bundles of scopes assigned to users (Owner, Administrator, Member, or custom) |
| Isolation | Per-user scoping throughout AgentOS for user-owned data and resources |
| Service accounts | Opaque `agno_pat_` tokens for machine callers, with scopes stored in your database |

## Learn How To

> **[Quickstart](https://agno-v2.mintlify.site/agent-os/security/authorization/quickstart.md)**
>
> Enable authorization, set a verification key, and make your first authenticated request.

> **[JSON Web Tokens (JWT)](https://agno-v2.mintlify.site/agent-os/security/authorization/tokens.md)**
>
> JWT claim structure, example tokens, and how AgentOS reads them.

> **[Self-Hosted (BYO Token)](https://agno-v2.mintlify.site/agent-os/security/authorization/self-hosted.md)**
>
> Run AgentOS without the control plane by issuing and verifying your own JWTs.

> **[Scopes](https://agno-v2.mintlify.site/agent-os/security/authorization/scopes.md)**
>
> Scope format and the full permission reference for every AgentOS endpoint.

> **[Roles](https://agno-v2.mintlify.site/agent-os/security/authorization/roles.md)**
>
> Default roles and custom roles defined in the control plane.

> **[Per-User Data Isolation](https://agno-v2.mintlify.site/agent-os/security/authorization/user-isolation.md)**
>
> Scope user-owned AgentOS data and resources to the caller's user ID.

> **[Service Accounts](https://agno-v2.mintlify.site/agent-os/security/authorization/service-accounts.md)**
>
> Mint, scope, and revoke opaque machine tokens.

## Examples

> **[Basic Authorization (Symmetric)](https://agno-v2.mintlify.site/agent-os/usage/rbac/basic-symmetric.md)**
>
> Enable authorization with a shared-secret JWT (HS256).

> **[Basic Authorization (Asymmetric)](https://agno-v2.mintlify.site/agent-os/usage/rbac/basic-asymmetric.md)**
>
> Sign with a private key, verify with the public key (RS256).

> **[Per-Agent Permissions](https://agno-v2.mintlify.site/agent-os/usage/rbac/per-agent-permissions.md)**
>
> Grant specific permissions to specific agents.

> **[Per-User Data Isolation](https://github.com/agno-agi/agno/blob/main/cookbook/05_agent_os/07_security/user_isolation.py)**
>
> Scope user-owned data and resources throughout AgentOS with `user_isolation=True`.

## Developer Resources

> **[JWT Middleware](https://agno-v2.mintlify.site/agent-os/middleware/jwt.md)**
>
> Configure token sources, claim extraction, and scope checking.

> **[AuthorizationConfig Reference](https://agno-v2.mintlify.site/reference/agent-os/authorization-config.md)**
>
> Configuration options for JWT verification.

> **[JWTMiddleware Reference](https://agno-v2.mintlify.site/reference/agent-os/jwt-middleware.md)**
>
> Complete JWT middleware class reference.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.