first commit

kong/openid-connect.yaml

@@ -0,0 +1,23 @@
+# For agents we build ourselves — real OIDC identity, unlike key-auth
+# callers (see key-auth.yaml). No token exchange: the upstream auth to
+# OpenRouter is handled entirely by ai-proxy-advanced's own static
+# credential, this plugin only authenticates/authorizes the calling agent.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-llm-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${AGENT_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  # Lets a request that fails THIS plugin fall through to key-auth instead
+  # of being rejected outright — "OR" auth across both plugins. Requires
+  # request-termination bound to this same consumer (see consumer.yaml) to
+  # actually reject a request that fails every auth plugin — without it,
+  # anonymous fallback alone would let unauthenticated requests through.
+  anonymous: ${LLM_ANONYMOUS_CONSUMER_ID}