Skip to main content
Identity controls who can invoke your managed deep agent, such as apps and SDK clients that start runs or send messages.
Managed Deep Agents is in public beta and available on LangSmith Cloud in the US region only.
Put the identity declaration at the project root:
For the full project layout, see Project structure.

​
Choose the identity provider

By default, mda init requires callers to present a LangSmith API key. Anyone who has that key can use the same deployment and may see the same threads. To give each signed-in end user private conversations, use Supabase instead: For more information, see Project structure.

​
Configure identity with a LangSmith API key

mda init scaffolds this identity provider as a secure default. Callers must present a valid LangSmith workspace API key. Managed Deep Agents verifies the key with LangSmith Cloud.
identity.ts
Clients send the key as x-api-key. You do not need to add verification endpoint or tenant settings to your project .env. LangSmith Cloud supplies those.
Anyone with the key can reach the deployment, so treat the key as a secret. This default does not give each end user private threads. If Alice must not see Bob’s threads, use Supabase.

​
Configure identity with Supabase

Use Supabase when a browser or another client calls the deployment as a signed-in entity. Each user gets private threads. Managed Deep Agents configures that ownership for you. For more information on the underlying LangSmith Deployment pattern, see Make conversations private.
1

Enable auth in Supabase

In the Supabase dashboard, enable the auth provider you will use (for example email/password).
2

Copy the project reference

Copy the project reference: the subdomain before .supabase.co in your project URL.
3

Declare identity

Declare identity with that project reference:
identity.ts
Pass url instead of the project reference for a custom auth domain.
4

Send the access token from the client

In the client app, set the Supabase project URL and publishable key (labeled anon in the Supabase dashboard). Sign the user in, then send the access token on every deployment request:
The publishable key (labeled anon in the Supabase dashboard) is only for the client to sign in with Supabase. Do not send a LangSmith API key in this mode. The Bearer token is the caller identity.Managed Deep Agents verifies the JWT against the project’s JWKS URL derived from your project reference (https://<project-ref>.supabase.co/auth/v1/.well-known/jwks.json).
Adding Supabase identity to an existing deployment does not add owner metadata to existing threads. Plan and test a migration before relying on identity-based access for those threads.

​
Test and deploy

Test the project locally with mda dev, then deploy it with mda deploy. Open deployment traces in LangSmith to inspect model calls, tool calls, errors, and latency. Authentication failures return 401. For the LangSmith API-key default, confirm that clients send x-api-key. For Supabase, confirm that clients send Authorization: Bearer <access_token>, that project_ref / projectRef matches your Supabase project, and that callers cannot access another user’s threads (403).
Connect these docs to Claude, VSCode, and more via MCP for real-time answers.
Edit this page on GitHub or file an issue.