Amazon Bedrock AgentCore now offers a managed Consent portal for AI agents that access GitHub, Slack and other OAuth-protected services on a user’s behalf. It removes a large piece of browser and session-binding code, but it does not collapse the identity model into one login.
The AWS announcement was published September 14, 2026. AgentCore Identity now provides the web experience and a session-binding endpoint for AgentCore Gateway. Tokens are stored in AgentCore Identity’s vault, and administrators can inspect consent activity in AWS CloudTrail.
The product solves a session-binding problem
Before this release, a team using the OAuth 2.0 authorization-code flow had to present the authorization URL, host a public HTTPS callback, authenticate the returning user, preserve the browser session and call CompleteResourceTokenAuth. The portal now handles those redirects and associates the provider grant with the employee who approved it.
Four identities participate in one agent tool call
| Actor | What it proves | What it must not imply |
|---|---|---|
| Employee | The human initiating consent | Employment alone does not grant every tool scope |
| Corporate IdP | The employee’s organizational identity | It does not replace GitHub or Slack authorization |
| AgentCore Gateway | The configured agent targets and execution boundary | Its role should not exceed the required gateway actions |
| External provider | The user’s approved OAuth grant | One provider’s grant does not authorize another provider |
The three callback URLs are not interchangeable
| Callback | Configured at | Purpose |
|---|---|---|
<portal-url>/callback | Corporate IdP application | Return after portal login |
<portal-url>/connect/callback | Gateway target default return URL | Return to managed session binding |
AgentCore Identity callbackUrl | GitHub, Slack or other outbound provider app | Send the provider authorization code to AgentCore Identity |
A common integration error is registering the portal login callback inside the provider app. AWS explicitly separates that URL from the generated AgentCore Identity callback used by GitHub or Slack.
Managed consent does not mean managed least privilege
- Request only the provider scopes needed for the named tools.
- Scope
iam:PassRoleto the Consent portal execution role. - Keep separate outbound credential providers for separate services.
- Review CloudTrail for consent, connection and administrative changes.
- Define revocation behavior when an employee leaves or a project ends.
A safe deployment order
- Create a development gateway with JWT inbound authorization.
- Register the corporate IdP and each outbound provider separately.
- Configure the minimum scopes and a tightly scoped execution role.
- Create the portal, then replace temporary callbacks with the final URLs.
- Connect one provider and verify that other providers remain disconnected.
- Invoke an allowed tool, an unapproved tool and a revoked grant from the same MCP client.
Why MCP clients make this timely
AWS names Kiro, Claude Code, Cursor and Visual Studio Code as relevant clients. The shared pattern is an assistant outside the browser that needs a user-bound grant before calling a remote tool. Pre-consent lets a developer authorize the provider in a managed page, return to the IDE and reuse the stored grant for later tool calls.
Our AgentCore MCP Apps guide covers how tools reach ChatGPT and Claude. The data-agent permissions guide explains why the user, connector and execution identity must stay distinguishable.
What to test before production
Test wrong audience tokens, expired corporate sessions, denied provider consent, missing scopes, a revoked provider token and a gateway target that the portal role cannot read. The correct result is a narrow failure with an auditable event, not a silent fallback to a shared credential.
The practical verdict
The Consent portal removes undifferentiated callback plumbing and gives AgentCore users a supported session-binding path. Its security value depends on keeping the four actors and three callbacks distinct. Treat it as an authorization component, not as permission to widen the agent’s access.
Primary source
Checked September 14, 2026. Product behavior and callback paths come from AWS. The threat checks and deployment sequence are MustHave.ai analysis.
