Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore

Amazon Bedrock's AgentCore Identity has introduced a Consent portal, a new managed web interface designed to streamline the process of end-user OAuth consent and session binding for AI agents. Previously, developers had to build and host their own infrastructure to handle OAuth flows, including authorization URL presentation, callback handling, user authentication, and token management. The new Consent portal simplifies this by providing a ready-to-use, secure web experience that handles browser redirects, session management, and token storage in the AgentCore token vault.

This feature is particularly useful for AI agents accessed through IDEs and Model Context Protocol (MCP) clients such as Kiro, Claude Code, Cursor, and Visual Studio Code. It allows users to grant consent for individual service providers like GitHub and Slack before invoking tools, with subsequent calls reusing stored tokens, thus reducing repetitive prompts.

The process involves an administrator configuring the corporate identity provider (IdP), setting up gateway targets for GitHub and Slack, creating the Consent portal, and registering callback URLs in the provider applications. Once set up, end users authenticate via the portal, review and approve access to services, and the portal manages the OAuth flow and session binding automatically.

AWS CloudTrail records all consent operations, providing an audit trail for security and compliance. This includes events such as OAuth token requests and session completions, with sensitive token data redacted.

The new capability enhances security and user experience by centralizing consent management, reducing development overhead, and providing clear activity logs. It is available for use with Amazon Bedrock AgentCore, with detailed setup instructions provided in the AWS documentation.