Comment on page

Gateway authentication

You can require authentication when someone attempts a connection to produce, consume, and chat gateways.
To fully implement this, there is quite a bit left up to the developer. The focus of gateway authentication is to provide transportation and validation. An identity provider facilitates authentication through a series of handshakes based on a provided token. Someone wanting to produce or consume a message provides an id that was created by the identity provider. The gateway handshakes with the identity provider using the provided token. Use parameters, headers, and clientId to configure the gateway to successfully handshake.
​This authentication example application provides more explanation and a working example.
Example gateways.yaml
This gateway manifest is selectively adding authentication to the user-input and bot-output gateways.
The gateways are filtering messages by two key-value pairs in the message headers: the sessionID parameter value, and the "subject" value from the langstream-client-user-id key.sessionId is a UUID generated by the CLI at runtime. Here, let's assume sessionId=123.
value-from-parameters defines what value is being used for filtering. Since it's sessionId, the sessionId value is 123.
Once a parameter is defined for a gateway, that parameter is required for every subsequent connection.
The producer will produce to the questions-topic with two header values:
1.langstream-client-session-id,with the arbitrary value "123" from the gateway parameters
2.langstream-client-user-id with the "subject" value from Google authentication
The consumer will watch for messages with these values in the headers on the questions-topic.
gateways:
  - id: "user-input"
    type: produce
    topic: "questions-topic"
    parameters:
      - sessionId
    authentication:
      provider: google
      configuration:
        clientId: "{{ secrets.google.client-id }}"
    produce-options:
      headers:
        - key: langstream-client-user-id
          value-from-authentication: subject
        - key: langstream-client-session-id
          value-from-parameters: sessionId
​
  - id: "bot-output"
    type: consume
    topic: "questions-topic"
    parameters:
      - sessionId
    authentication:
      provider: google
      configuration:
        clientId: "{{ secrets.google.client-id }}"
    produce-options:
      headers:
        - key: langstream-client-user-id
          value-from-authentication: subject
        - key: langstream-client-session-id
          value-from-parameters: sessionId
Google authentication
Set provider: google to use a Google client ID to authenticate LangStream gateway connections.
The Google field that is exposed for authentication is "subject".
Follow the “Get your Google API client ID” guide to create your client ID.
The Google client ID looks like this:
99840107278-4363876v0hker43roujaubqom5g07or8.apps.googleusercontent.com
To set it as a secret env variable:
export GOOGLE_CLIENT_ID=99840107278-4363876v0hker43roujaubqom5g07or8.apps.googleusercontent.com
Github authentication
Set provider: github to use a GitHub login to authenticate LangStream gateway connections.
The Github field that is exposed for authentication is "login".
Follow the “Building a "Login with GitHub" button with a GitHub App” guide to create your login.
Configuration
Label
Type
Description
provider
string
The name of the identity provider. Supported values are:
“google”
“github”
configuration

Map
For the google provider, follow the “Get your Google API client ID” guide.
For the github provider, follow the “Building a "Login with GitHub" button with a GitHub App” guide.
clientId

string
The token to use for interacting with the given identity provider. Typically this is a pointer to a secret.
Example: clientId: "${secrets.google.client-id}"

Label	Type	Description
provider	string	The name of the identity provider. Supported values are: “google” “github”
configuration	Map	For the google provider, follow the “Get your Google API client ID” guide. For the github provider, follow the “Building a "Login with GitHub" button with a GitHub App” guide.
clientId	string	The token to use for interacting with the given identity provider. Typically this is a pointer to a secret. Example: clientId: "${secrets.google.client-id}"

Message filtering

Next - Building Applications

API Reference

Last modified 28d ago