> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Gateway

> Agents reach models, tools, and other agents through a singular, unified instance on the user's Network.

> [!WARNING]
>
> **Beta.** Rows marked Preview or Planned arrive in later releases.

**On the data plane**, an Agent Gateway instance sits inline between agents and their [*targets*](#targets), [*on the user's Network*](#virtual-private-cloud), off the internet. It [*authenticates to each target*](#outbound-authentication) with credentials it holds, and [*authenticates every request*](#inbound-authentication) an agent sends to its `gateway_url`.

**On the control plane**, at `api.telnyx.com`, the user sets each agent's [*authorization and policy*](#authorization-and-policy), [*controls its traffic*](#traffic-control), and [*audits its requests*](#audit-and-observability).

## Targets

| Target | What It Does | Availability |
| - | - | - |
| [Models](https://developers.telnyx.com/docs/agent-gateway/targets/models.md) | One OpenAI-compatible endpoint for every model an agent uses. | Beta |
| [Tools](https://developers.telnyx.com/docs/agent-gateway/targets/tools.md) | Tools from Model Context Protocol (MCP) servers and REST APIs, served to the agent through one MCP endpoint. With [tool search](https://developers.telnyx.com/docs/agent-gateway/targets/tools.md#tool-search), the agent loads only the tools it needs. | Beta |
| Agents | Requests to other agents over agent-to-agent (A2A). | Planned |

## Virtual Private Cloud

| Component | Where It Runs | Availability |
| - | - | - |
| [Agents](https://developers.telnyx.com/docs/agent-gateway/vpc.md) | Edge Compute functions on the user's [*Network*](https://developers.telnyx.com/docs/network/overview.md). Each sends its requests to `gateway_url`. | Preview |
| [Forwarding peer](https://developers.telnyx.com/docs/agent-gateway/vpc.md) | A WireGuard peer inside the user's network that forwards the instance's requests to its subnets. | Preview |
| [Tunnel hosts](https://developers.telnyx.com/docs/agent-gateway/vpc.md) | Hosts inside the user's network that run a [Tunnel](https://developers.telnyx.com/docs/network/tunnel.md) to Telnyx. | Preview |

## Outbound Authentication

Outbound authentication is not a resource of its own. Each MCP server and API holds its method and credentials in its [`auth`](https://developers.telnyx.com/docs/agent-gateway/targets/tools#outbound-authentication).

| Method | How It Works | Availability |
| - | - | - |
| [API keys](https://developers.telnyx.com/docs/agent-gateway/outbound/api-keys.md) | The gateway sends a static API key, bearer token, or password with every request to the server. | Beta |
| [OAuth client credentials](https://developers.telnyx.com/docs/agent-gateway/outbound/oauth-client-credentials.md) | The gateway trades a client ID and secret for a short-lived access token from the server's OAuth provider, and renews it before it expires. | Beta |
| OAuth authorization code | Each user authorizes the gateway once, and the gateway sends the server that user's own token. | Planned |
| OAuth token exchange | The gateway exchanges the agent's token for one issued for the server, on the user's behalf. | Planned |
| [Token passthrough](https://developers.telnyx.com/docs/agent-gateway/outbound/token-passthrough.md) | The gateway forwards the agent's own token to the server unchanged. | Beta |
| [AWS Signature Version 4](https://developers.telnyx.com/docs/agent-gateway/outbound/aws-signature-v4.md) | The gateway signs each request to a server on AWS with stored AWS keys or an assumed role. | Beta |

## Inbound Authentication

| Method | How It Works | Availability |
| - | - | - |
| [Keys](https://developers.telnyx.com/docs/agent-gateway/authentication/keys.md) | The gateway issues a key to each agent or team, and the agent presents it on every request. | Beta |
| Identity provider tokens | The agent authenticates with a token from the user's own identity provider over OpenID Connect (OIDC), such as Okta or Microsoft Entra ID. The token's claims identify the agent and its groups, and the gateway itself issues no keys. | Planned |

## Authorization and Policy

| Control | How It Works | Availability |
| - | - | - |
| [Allow lists](https://developers.telnyx.com/docs/agent-gateway/authorization/allow-lists.md) | Each key or team names the models it may use. A model outside its list is refused. | Beta |
| [Tool permissions](https://developers.telnyx.com/docs/agent-gateway/authorization/tool-permissions.md) | Each key or team names the MCP servers and tools it may use, and the agents it may reach. The agent sees only those tools. | Beta |
| [Guardrails](https://developers.telnyx.com/docs/agent-gateway/authorization/guardrails.md) | Checks that run before and after each request to a model or tool, such as masking personal data or blocking keywords. They run on every request or on the requests that name them. | Beta |
| [Policies](https://developers.telnyx.com/docs/agent-gateway/authorization/policies.md) | Named sets of guardrails that build on a base policy. They apply to every request, to some models, or to the requests that name them. | Beta |

## Traffic Control

| Control | How It Works | Availability |
| - | - | - |
| [Budgets and rate limits](https://developers.telnyx.com/docs/agent-gateway/traffic/budgets-and-rate-limits.md) | A spend cap in USD, and requests and tokens per minute, per key and per team. A request past a limit is refused. | Beta |
| [Routing and fallbacks](https://developers.telnyx.com/docs/agent-gateway/traffic/routing-and-fallbacks.md) | Retries, timeouts, and fallbacks to another model when one fails. | Beta |
| Caching | Repeated requests are answered from a cache. | Planned |

## Audit and Observability

| Record | What It Holds | Availability |
| - | - | - |
| [Spend logs](https://developers.telnyx.com/docs/agent-gateway/observability/spend-logs.md) | Every request, with its key, team, model, tokens, cost, status, and duration. | Beta |
| Traces and metrics | A trace per request in OpenTelemetry, and request, error, and latency metrics per key, team, and model. | Planned |
| Log export | Request logs sent to the user's own observability tools, such as an OpenTelemetry collector, Langfuse, Datadog, or S3. | Planned |
| Audit logs | Who created, changed, or deleted a key, team, or model, and when. | Planned |