If you've ever wired an AI agent up to call GitHub, Salesforce, or Slack on someone's behalf, you know OAuth is the annoying part.
Three-legged OAuth needs a callback URL. Something has to catch the redirect, show the user a consent screen, exchange the code for a token, and hand it back to your agent securely. Building that yourself usually means standing up a small web server, hosting it somewhere, and remembering to keep it patched, all so a user can click "allow."
I've built that callback service before, for a regular web app, not even an agent. It took a couple of days to get right and longer than that to trust. Multiply that by every agent integration your team ships, and it adds up fast.
AWS just took that off your plate. As of September 1, Bedrock AgentCore Identity ships a managed consent portal. Every AgentCore Gateway gets its own hosted web client with a dedicated URL. Send your team or your users to that link. They review what the agent is asking to access, they approve it, and AgentCore handles the token exchange on the back end. You skip building and babysitting the callback infrastructure yourself.
AI can build faster. Can your team decide better?
AI can draft the PRD and prototype the idea. Jira Product Discovery helps teams decide whether it belongs on the roadmap. Bring feedback and ideas together, prioritize as a team, and keep your roadmap connected to delivery in Jira.
There's a specific pain point behind this, too. A lot of agent clients, IDE plugins and CLI tools especially, can't pop open a browser and catch a redirect the way a normal web app can. The consent portal solves that by giving those clients a plain URL they can print to a terminal or drop in a tab, and the user finishes the approval separately. AWS calls this out by name for IDE-based agents, which tells you where a good chunk of their users have been getting stuck.
Users also get a self-service view of what they've already connected. Nobody has to email an admin to ask if they already approved an agent for Salesforce last month.
This builds on the On-Behalf-Of token exchange AgentCore Identity picked up back in April, which handled the token side of letting an agent act as a specific user rather than a shared service account. The consent portal is the piece that was still missing, the actual screen a human sees before any of that kicks in.
This is the third AgentCore update I've covered in this newsletter in about a month, after the Web Search filtering in August and the longer-running Runtime Instances before that. AWS is iterating on this service faster than most teams can realistically track. If you're building agents that touch third-party tools, the consent portal is worth 15 minutes of your time. Identity and OAuth are exactly the kind of thing you don't want to build twice, or badly.
It's live now in every commercial region where AgentCore Identity is available, with no separate pricing tier attached. If you're already using AgentCore Gateway to connect agents to GitHub, Slack, or similar services, it's worth checking your existing OAuth setup. There's a decent chance some of your own callback code is now redundant.
Keep Learning and Building.