Check an AI agent’s API permissions before production

Gate Setup Check reads your actual integration settings and explains what needs attention. An agent can give its human a concrete report before receiving production access.

The problem

A valid key does not show whether writes require a scoped run, whether the project is only observing violations, or whether approval decisions belong to a separate person. Configuration syntax can be valid while these decisions remain unfinished.

Read the current settings

Open the dashboard and use Gate Setup Check, or ask your coding agent to call gate_check_setup. Pass the project id and read the admin key from your backend environment; do not paste credentials into a prompt. An optional app filters the report to one active app.

curl -sS "https://gate.odilelabs.com/api/projects/$ODILE_GATE_PROJECT/setup-check" \
  -H "Authorization: Bearer $ODILE_GATE_ADMIN_KEY"

The JavaScript backend client provides admin.checkSetup() or admin.checkSetup(appId). No upstream requests are sent, no policy changes are made, and the check uses no gateway-call allowance. It is available on Free and Pro.

What the report tells you

The JSON marks verification: configuration_only, records a check time and lists the observed settings. Findings cover observe-only mode, writes without mandatory runs, user-scoped routes missing JWT configuration, wildcard grants and approval runs without a dedicated human approver. Revoked and suspended apps are excluded. Each finding includes evidence and a real admin API remedy; instructions that need your values are marked requires_input.

What to do next

Review the findings with the human responsible for the integration. Set writes or all calls to require a run when an autonomous agent needs narrow session permissions. Keep a dedicated approver key outside the agent’s context when independent approval is needed. Refresh the check after changing settings, then test an allowed request and the refusals your integration depends on.

Configuration is not proof of runtime security

A configured report is not a security certificate. It does not test direct access around Gate, backend ownership checks or row-level security, JWKS connectivity and real user tokens, or runtime run limits and approval execution. Keep those protections and verify the real integration. Missing JWT configuration makes user-scoped routes fail closed; it does not grant access.

Free for 3 apps and 10,000 calls a month. Continue with customer-scoped actions, exact approvals and safe retries.