> ## Documentation Index
> Fetch the complete documentation index at: https://agno-v2.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Basic RBAC (Symmetric)

> AgentOS with RBAC enabled using JWT HS256 and a shared secret.

Enable RBAC with JWT token authentication using HS256 and a shared secret. The same secret signs tokens and verifies them.

**1. Create a Python file**

```python basic_rbac.py theme={null}
import os
from datetime import UTC, datetime, timedelta

import jwt
from agno.agent import Agent
from agno.db.postgres import PostgresDb
from agno.models.openai import OpenAIResponses
from agno.os import AgentOS
from agno.os.config import AuthorizationConfig
from agno.tools.hackernews import HackerNewsTools

JWT_SECRET = os.getenv("JWT_VERIFICATION_KEY")
if not JWT_SECRET:
    raise RuntimeError("Set JWT_VERIFICATION_KEY before starting AgentOS")

# Setup database
db = PostgresDb(db_url="postgresql+psycopg://ai:ai@localhost:5532/ai")

# Create agent
research_agent = Agent(
    id="research-agent",
    name="Research Agent",
    model=OpenAIResponses(id="gpt-5.2"),
    db=db,
    tools=[HackerNewsTools()],
    add_history_to_context=True,
    markdown=True,
)

# Create AgentOS with RBAC enabled
agent_os = AgentOS(
    id="my-agent-os",
    description="RBAC Protected AgentOS",
    agents=[research_agent],
    authorization=True,
    authorization_config=AuthorizationConfig(
        verification_keys=[JWT_SECRET],
        algorithm="HS256",
    ),
)

# Get the app
app = agent_os.get_app()


if __name__ == "__main__":
    # Create test tokens with different scopes
    user_token = jwt.encode(
        {
            "sub": "user_123",
            "session_id": "session_456",
            "scopes": ["agents:read", "agents:run"],
            "exp": datetime.now(UTC) + timedelta(hours=24),
            "iat": datetime.now(UTC),
        },
        JWT_SECRET,
        algorithm="HS256",
    )

    admin_token = jwt.encode(
        {
            "sub": "admin_789",
            "session_id": "admin_session_123",
            "scopes": ["agent_os:admin"],
            "exp": datetime.now(UTC) + timedelta(hours=24),
            "iat": datetime.now(UTC),
        },
        JWT_SECRET,
        algorithm="HS256",
    )

    print("User Token (agents:read, agents:run):")
    print(user_token)
    print("\nAdmin Token (agent_os:admin - full access):")
    print(admin_token)

    agent_os.serve(app="basic_rbac:app", port=7777, reload=True)
```

<Snippet file="create-venv-step.mdx" />

**2. Install dependencies**

```bash theme={null}
uv pip install -U agno openai pyjwt "fastapi[standard]" uvicorn sqlalchemy pgvector psycopg
```

**3. Export API and JWT keys**

```bash Mac/Linux theme={null}
export OPENAI_API_KEY="your_openai_api_key_here"
export JWT_VERIFICATION_KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')"
```

```bash Windows theme={null}
$Env:OPENAI_API_KEY="your_openai_api_key_here"
$Env:JWT_VERIFICATION_KEY = python -c "import secrets; print(secrets.token_hex(32))"
```

**4. Setup PostgreSQL Database**

```bash theme={null}
docker run -d \
  --name agno-postgres \
  -e POSTGRES_DB=ai \
  -e POSTGRES_USER=ai \
  -e POSTGRES_PASSWORD=ai \
  -p 5532:5432 \
  pgvector/pgvector:pg17
```

**5. Run the AgentOS**

```bash theme={null}
python basic_rbac.py
```

The server will start and print test JWT tokens to the console.

**6. Test RBAC**

```bash theme={null}
# Set the token from console output
export TOKEN="<user_token_from_console>"

# List agents
curl -H "Authorization: Bearer $TOKEN" http://localhost:7777/agents

# Run an agent
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -F "message=Search for latest AI news" \
  http://localhost:7777/agents/research-agent/runs
```

## Next Steps

* [Basic RBAC (Asymmetric)](https://agno-v2.mintlify.site/agent-os/usage/rbac/basic-asymmetric.md)
* [Advanced Scopes](https://agno-v2.mintlify.site/agent-os/usage/rbac/advanced-scopes.md)
* [Per-Agent Permissions](https://agno-v2.mintlify.site/agent-os/usage/rbac/per-agent-permissions.md)
* [RBAC Documentation](https://agno-v2.mintlify.site/agent-os/security/authorization/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.