AgentCore Gateway adds OBO token exchange configuration
Understand this story
Amazon Bedrock AgentCore Gateway can be configured with on-behalf-of (OBO) token exchange, allowing AI agents to preserve the identity of the user who initiated the request when calling ServiceNow REST APIs. AWS describes this configuration method in a blog post. This native OBO support requires a specific MCP version; gateways created with earlier MCP versions cannot enable native OBO. The blog post also reminds readers to promptly delete resources created for testing to avoid ongoing charges.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- AWS Machine Learning BlogServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway
This post explains how to configure Amazon Bedrock AgentCore Gateway for an on-behalf-of (OBO) token exchange with Microsoft Entra ID so an AI agent can call the ServiceNow REST API while preserving the calling user's identity. It covers creating Entra application registrations for the agent and a ServiceNow API connector, configuring a ServiceNow inbound OAuth integration with an OIDC provider, and setting up the gateway with MCP version 2025-11-25, an outbound OAuth client using the JWT authorization grant, and a target with the token exchange grant (scope plus requested_token_use: on_behalf_of). The post states that native OBO support removes the need for custom AWS Lambda interceptors to perform token exchanges.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 4 02:00
- Change in the past 24 hours
- -49%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.