# For agents we build ourselves — real OIDC identity, unlike key-auth
# callers (see key-auth.yaml). No token exchange: the upstream auth to
# OpenRouter is handled entirely by ai-proxy-advanced's own static
# credential, this plugin only authenticates/authorizes the calling agent.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-llm-openid-connect
  namespace: ${NAMESPACE}
plugin: openid-connect
config:
  issuer: ${OIDC_ISSUER}
  audience_required: ${AGENT_AUDIENCE}
  auth_methods:
    - bearer
  display_errors: false
  ssl_verify: true
  # Lets a request that fails THIS plugin fall through to key-auth instead
  # of being rejected outright — "OR" auth across both plugins. Requires
  # request-termination bound to this same consumer (see consumer.yaml) to
  # actually reject a request that fails every auth plugin — without it,
  # anonymous fallback alone would let unauthenticated requests through.
  anonymous: ${LLM_ANONYMOUS_CONSUMER_ID}