Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Parameter reference for AuthorizationConfig, which configures JWT verification for AgentOS RBAC authorization.
from agno.os.config import AuthorizationConfig
agno[os] extra installs base PyJWT. Add PyJWT’s optional cryptography dependencies for RS* and ES* algorithms:
uv pip install "PyJWT[crypto]"
| Parameter | Type | Default | Description |
|---|---|---|---|
verification_keys | Optional[List[str]] | None | List of keys used to verify JWT signatures. For asymmetric algorithms (e.g. RS256), use public keys. For symmetric algorithms (e.g. HS256), use shared secrets. Each key is tried in order until one succeeds. Useful for accepting tokens from multiple issuers. |
jwks_file | Optional[str] | None | Path to a static JWKS (JSON Web Key Set) file containing public keys. Keys are matched by kid (key ID) from the JWT header. Alternative to verification_keys for RSA key management. |
algorithm | Optional[str] | None ("RS256" when unset) | JWT algorithm for token verification. Common options: RS256 (asymmetric), HS256 (symmetric). |
verify_audience | Optional[bool] | None (treated as False) | Whether to verify the JWT’s aud claim matches the expected audience. |
audience | Optional[str] | AgentOS id | Expected audience claim. When verify_audience=True, the token’s aud must match this value. Defaults to the AgentOS id. |
admin_scope | Optional[str] | None ("agent_os:admin" when unset) | The scope that grants full admin access. Holders bypass user isolation and can access all data. |
user_isolation | bool | False | Opt-in per-user isolation for user-owned data and resources throughout AgentOS. When True, non-admin callers can only access data and resources associated with their JWT sub claim. |
user_isolation=True, every non-admin JWT must include a non-empty string sub claim. Configure the token issuer or an authentication layer to reject tokens without this claim before they reach AgentOS. A token without a usable sub can pass JWT verification, but AgentOS cannot apply per-user filtering or ownership enforcement to that caller.from agno.os import AgentOS
from agno.os.config import AuthorizationConfig
agent_os = AgentOS(
id="my-agent-os",
agents=[my_agent],
authorization=True,
authorization_config=AuthorizationConfig(
verification_keys=["your-public-key-or-secret"],
algorithm="RS256",
),
)
| Algorithm | Type | Key Format |
|---|---|---|
RS256 | Asymmetric (RSA) | Public key (PEM format) |
RS384 | Asymmetric (RSA) | Public key (PEM format) |
RS512 | Asymmetric (RSA) | Public key (PEM format) |
HS256 | Symmetric (HMAC) | Shared secret string |
HS384 | Symmetric (HMAC) | Shared secret string |
HS512 | Symmetric (HMAC) | Shared secret string |
ES256 | Asymmetric (ECDSA) | Public key (PEM format) |
ES384 | Asymmetric (ECDSA) | Public key (PEM format) |
ES512 | Asymmetric (ECDSA) | Public key (PEM format) |
# RS256 with a public key
authorization_config = AuthorizationConfig(
verification_keys=["""-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----"""],
algorithm="RS256",
)
# HS256 with a shared secret
authorization_config = AuthorizationConfig(
verification_keys=["your-256-bit-secret-key"],
algorithm="HS256",
)
# RS256 with a JWKS file
authorization_config = AuthorizationConfig(
jwks_file="/path/to/jwks.json",
algorithm="RS256",
)
{
"keys": [
{
"kty": "RSA",
"kid": "my-key-id",
"use": "sig",
"alg": "RS256",
"n": "0vx7agoebGc...",
"e": "AQAB"
}
]
}
Was this page helpful?