> ## Documentation Index
> Fetch the complete documentation index at: https://langchain-5e9cc07a-preview-contex-1789468204-c45d5ed.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Add identity to Managed Deep Agents

> Authenticate callers to a Managed Deep Agents deployment with a LangSmith API key or Supabase.

Identity controls who can invoke your managed deep agent, such as apps and SDK clients that start runs or send messages.

<Note>
  Managed Deep Agents is in **public [beta](/langsmith/release-stages)** and available on [LangSmith Cloud](/langsmith/cloud) in the US region only.
</Note>

Put the identity declaration at the project root:

```text theme={null}
my-agent/
  agent.ts
  identity.ts
```

For the full project layout, see [Project structure](/langsmith/javascript/managed-deep-agents-project-structure).

## Choose the identity provider

By default, `mda init` requires callers to present a LangSmith API key. Anyone who has that key can use the same deployment and may see the same threads. To give each signed-in end user private conversations, use Supabase instead:

| Goal                                                            | Use                                                                         |
| --------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Lock down the deployment for SDK clients, scripts, and services | [LangSmith API key (default)](#configure-identity-with-a-langsmith-api-key) |
| Signed-in end users with private chats                          | [Supabase](#configure-identity-with-supabase)                               |

For more information, see [Project structure](/langsmith/javascript/managed-deep-agents-project-structure).

## Configure identity with a LangSmith API key

`mda init` scaffolds this identity provider as a secure default. Callers must present a valid LangSmith workspace API key. Managed Deep Agents verifies the key with LangSmith Cloud.

```ts identity.ts theme={null}
import { auth, defineIdentity } from "managed-deepagents";

export const identity = defineIdentity({
  auth: auth.langsmithApiKey(),
});
```

Clients send the key as `x-api-key`. You do not need to add verification endpoint or tenant settings to your project `.env`. LangSmith Cloud supplies those.

<Warning>
  Anyone with the key can reach the deployment, so treat the key as a secret. This default does not give each end user private threads. If Alice must not see Bob's threads, use [Supabase](#configure-identity-with-supabase).
</Warning>

## Configure identity with Supabase

Use Supabase when a browser or another client calls the deployment as a signed-in entity. Each user gets private threads. Managed Deep Agents configures that ownership for you. For more information on the underlying LangSmith Deployment pattern, see [Make conversations private](/langsmith/resource-auth).

<Steps>
  <Step title="Enable auth in Supabase" id="enable-auth-in-supabase">
    In the Supabase dashboard, enable the auth provider you will use (for example email/password).
  </Step>

  <Step title="Copy the project reference" id="copy-the-project-reference">
    Copy the project reference: the subdomain before `.supabase.co` in your project URL.
  </Step>

  <Step title="Declare identity" id="declare-supabase-identity">
    Declare identity with that project reference:

    ```ts identity.ts theme={null}
    import { auth, defineIdentity } from "managed-deepagents";

    export const identity = defineIdentity({
      auth: auth.supabase({ projectRef: "your-project-ref" }),
    });
    ```

    Pass `url` instead of the project reference for a custom auth domain.
  </Step>

  <Step title="Send the access token from the client" id="send-the-access-token">
    In the client app, set the Supabase project URL and publishable key (labeled `anon` in the Supabase dashboard). Sign the user in, then send the access token on every deployment request:

    ```ts theme={null}
    await fetch(`${deploymentUrl}/threads/${threadId}/runs`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${supabaseAccessToken}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify(runBody),
    });
    ```

    The publishable key (labeled `anon` in the Supabase dashboard) is only for the client to sign in with Supabase. Do not send a LangSmith API key in this mode. The Bearer token is the caller identity.

    Managed Deep Agents verifies the JWT against the project's JWKS URL derived from your project reference (`https://<project-ref>.supabase.co/auth/v1/.well-known/jwks.json`).

    <Note>
      Adding Supabase identity to an existing deployment does not add owner metadata to existing threads. Plan and test a migration before relying on identity-based access for those threads.
    </Note>
  </Step>
</Steps>

## Test and deploy

Test the project locally with [`mda dev`](/langsmith/javascript/managed-deep-agents-cli#develop-locally), then deploy it with [`mda deploy`](/langsmith/javascript/managed-deep-agents-deploy). Open deployment traces in LangSmith to inspect model calls, tool calls, errors, and latency.

Authentication failures return 401. For the LangSmith API-key default, confirm that clients send `x-api-key`. For Supabase, confirm that clients send `Authorization: Bearer <access_token>`, that `project_ref` / `projectRef` matches your Supabase project, and that callers cannot access another user's threads (403).

***

<div className="source-links">
  <Callout icon="terminal-2">
    [Connect these docs](/use-these-docs) to Claude, VSCode, and more via MCP for real-time answers.
  </Callout>

  <Callout icon="edit">
    [Edit this page on GitHub](https://github.com/langchain-ai/docs/edit/main/src/langsmith/managed-deep-agents-identity.mdx) or [file an issue](https://github.com/langchain-ai/docs/issues/new/choose).
  </Callout>
</div>