General

The General module centralizes the global parameters that AI Gateway uses to validate access tokens and integrate with Sensedia Platform. Unlike the other features, General is not a listing page. It is a single page with an update form.

IMPORTANT

The values registered here affect all gateway routes. Changing the Authorization Server changes who issues the tokens the gateway accepts: tokens issued by the previous provider start being rejected as soon as the new configuration is saved.

Quick links

Learn how to:

• Edit the global configuration
• Use the platform Authorization Server
• Use your own Authorization Server
• Register and edit the Sensedia Platform credentials
• Review the form fields

Editing

Platform Authorization Server

With the Use a custom authorization server option unchecked, the gateway validates access tokens against the platform's own Authorization Server. This is the default mode and requires no additional configuration: the credentials issued in AI Agents and the scopes registered in Scopes work without you providing any URL.

Your own Authorization Server

Check Use a custom authorization server to validate tokens against your own OpenID Provider. When you check the option, the Well-Known URL field appears and becomes required.

Provide the URL of your provider's OpenID discovery document (usually ending in /.well-known/openid-configuration). On save, the gateway:

1. Accesses the well-known document you provided.
2. Extracts the issuer (issuer) and the address of the public key set (jwks_uri) from it.
3. Accesses that key set and verifies that it contains at least one signing key.

Only after these three checks is the configuration accepted. From then on, the gateway accepts only tokens issued by the discovered issuer and signed by one of those keys.

THE URL MUST BE PUBLIC

The Well-Known URL is accessed by the gateway itself at the moment you save, so it must be a publicly reachable address. Internal, private, or loopback URLs are rejected.

VALIDATION ERRORS

If any of the three steps fails — unreachable document, missing jwks_uri, or an empty key set or one without a signing key — the form displays the corresponding message and the configuration is not saved. Check the URL and your provider's public availability before trying again.

To go back to the platform Authorization Server, uncheck the option — the Well-Known URL field is cleared — and click Save.

Sensedia Platform credentials

The Sensedia Platform Client ID / Sensedia Platform Client Secret pair is the client_credentials credential AI Gateway uses to query the Sensedia Platform APIs — in particular the multigateway catalog, the source of the APIs, revisions, and OpenAPI contract used by MCP Servers with the From an API origin.

The credential must be an M2M (Machine-to-Machine) credential, created on the Client Apps screen in Access Control. U2M credentials — the user ones — are not accepted by AI Gateway.

REQUIRED FOR THE FROM AN API ORIGIN

Although the form lets you save the global configuration without them, the credentials are required for every MCP Server with the From an API origin: without the registered pair, the operation returns an error. The M2M credential registered here must also hold the List MCP Servers (ai-gateway.mcp-servers.list) permission in Access Control — that permission is what authorizes reading the catalog's APIs, revisions, and contracts. Without it, those reads return 403. MCP Servers with the From an existing MCP Server origin do not depend on these credentials.

Editing the credentials

The General form never shows the already registered Sensedia Platform Client Secret — the field always opens blank, with the text Leave blank to keep the current secret. Client ID and Client Secret form an indivisible pair: they are provided together, or both left blank.

• Keep the current credentials: leave Sensedia Platform Client ID and Sensedia Platform Client Secret as they are (the Client ID comes prefilled) and adjust only the other fields. The registered pair is preserved.
• Replace the credentials: provide both fields — Client ID and Client Secret — together.
• Remove the credentials: clear both fields and click Save. Providing only one of the two (for example, a new Client ID with a blank Client Secret) results in a validation error. Removing the pair prevents new MCP Servers with the From an API origin from being created and makes the existing ones fail as soon as they need to fetch the revision's contract again.

Form fields

The table below covers all fields visible in the form.