Amazon Bedrock AgentCore Identity now offers a managed consent portal for AI agents that need to use external services on a person’s behalf. The portal handles authentication, displays configured provider connections and records approval for individual services.
The feature addresses session binding: securely associating an OAuth authorization grant with the user who approved it. AgentCore customers previously had to host a public HTTPS callback, authenticate the returning user, maintain browser sessions and call an API to finish the authorization-code flow.
An administrator creates a portal for an AgentCore Gateway and shares its URL. Users sign in through their organization’s identity provider, review services such as GitHub or Slack and grant consent. AgentCore stores resulting tokens in its token vault, allowing later tool calls to use the grant for that user. Activity can be reviewed in AWS CloudTrail.
The workflow is intended for agents reached through IDEs and Model Context Protocol clients, including Kiro, Claude Code, Cursor and Visual Studio Code. A managed page removes substantial authentication plumbing, but administrators still control which targets exist, which permissions providers request and which IAM role operates the portal. Consent remains meaningful only when scopes are understandable and can be revoked.