# Select: none | basic | api_key | bearer_static | jwt | oauth2_introspection | trusted_proxy
AGENT_AUTH_MODE=basic

# Public endpoints. Avoid exposing /debug in production.
AGENT_AUTH_PUBLIC_PATHS=/health,/docs,/openapi.json,/redoc
AGENT_AUTH_PUBLIC_PREFIXES=

# HTTP Basic - TIA -> Agent example
AGENT_AUTH_BASIC_CLIENT_ID=tia-contas
# Supported formats: plain:value | sha256:hex | pbkdf2_sha256:iterations:salt:digest
AGENT_AUTH_BASIC_SECRET_HASH=pbkdf2_sha256:310000:replace-salt:replace-digest
AGENT_AUTH_BASIC_REALM=agent-contas

# API Key
# AGENT_AUTH_API_KEY_HEADER=x-api-key
# AGENT_AUTH_API_KEY_HASH=sha256:replace-hex
# AGENT_AUTH_API_KEY_PRINCIPAL=tia

# Static Bearer token
# AGENT_AUTH_BEARER_TOKEN_HASH=sha256:replace-hex
# AGENT_AUTH_BEARER_PRINCIPAL=tia

# JWT / OIDC access token validation. For production, prefer asymmetric algorithms.
# AGENT_AUTH_JWT_KEY=-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----
# AGENT_AUTH_JWT_ALGORITHMS=RS256
# AGENT_AUTH_JWT_AUDIENCE=agent-contas
# AGENT_AUTH_JWT_ISSUER=https://identity.example.com/

# OAuth2 opaque-token introspection
# AGENT_AUTH_OAUTH2_INTROSPECTION_URL=https://identity.example.com/oauth2/introspect
# AGENT_AUTH_OAUTH2_CLIENT_ID=agent-contas
# AGENT_AUTH_OAUTH2_CLIENT_SECRET=replace-from-vault
# AGENT_AUTH_OAUTH2_TIMEOUT_SECONDS=5

# Authentication delegated to API Gateway / service mesh.
# Only trust these headers when direct access to the pod is blocked.
# AGENT_AUTH_PROXY_SUBJECT_HEADER=x-authenticated-subject
# AGENT_AUTH_PROXY_SHARED_SECRET_HEADER=x-internal-auth
# AGENT_AUTH_PROXY_SHARED_SECRET_HASH=sha256:replace-hex
