Add identity to Managed Deep Agents

Identity controls who can call your Managed Deep Agents deployment. By default, identity is secure: mda init configures authentication with a LangSmith API key. That default answers whether a caller is allowed. To also keep each signed-in person’s conversations private, use Supabase.

Managed Deep Agents is in public beta and available on LangSmith Cloud in the US region only.

Choose a path

Goal	Use
Lock down the deployment for SDK clients, scripts, and services	LangSmith API key (default)
Signed-in end users with private chats	Supabase

Default: LangSmith API key

mda init scaffolds this secure default. Callers must present a valid LangSmith workspace API key. Managed Deep Agents verifies the key with LangSmith Cloud.

identity.py

from managed_deepagents import auth, define_identity

identity = define_identity(auth=auth.langsmith_api_key())

Clients send the key as x-api-key. You do not need to add verification endpoint or tenant settings to your project .env. LangSmith Cloud supplies those. Anyone with the key can reach the deployment, so treat the key as a secret. This default does not give each end user private threads. If Alice must not see Bob’s threads, use Supabase.

Project structure

The identity declaration lives at the project root:

my-agent/
  agent.py
  identity.py

Authenticate end users with Supabase

Use Supabase when a browser or another client calls the deployment as a signed-in person. Each user gets private threads. Managed Deep Agents configures that ownership for you. For more information on the underlying LangSmith Deployment pattern, see Make conversations private. To configure Supabase authentication:

In the Supabase dashboard, enable the auth provider you will use (for example email/password).
Copy the project reference: the subdomain before .supabase.co in your project URL.
Declare identity with that project reference:

identity.py

from managed_deepagents import auth, define_identity

identity = define_identity(
    auth=auth.supabase(project_ref="your-project-ref"),
)

Pass url instead of the project reference for a custom auth domain.

In the client app, set the Supabase project URL and publishable (anon) key. Sign the user in, then send the access token on every deployment request:

import httpx

response = httpx.post(
    f"{deployment_url}/threads/{thread_id}/runs",
    headers={
        "Authorization": f"Bearer {supabase_access_token}",
        "Content-Type": "application/json",
    },
    json=run_body,
)

The publishable (anon) key is only for the client to sign in with Supabase. Do not send a LangSmith API key in this mode. The Bearer token is the caller identity. Managed Deep Agents verifies the JWT against the project’s JWKS URL derived from your project reference (https://<project-ref>.supabase.co/auth/v1/.well-known/jwks.json).

Adding Supabase identity to an existing deployment does not add owner metadata to existing threads. Plan and test a migration before relying on identity-based access for those threads.

Test and deploy

Test the project locally with mda dev, then deploy it with mda deploy. Open deployment traces in LangSmith to inspect model calls, tool calls, errors, and latency. Authentication failures return 401. For the LangSmith API-key default, confirm that clients send x-api-key. For Supabase, confirm that clients send Authorization: Bearer <access_token>, that project_ref / projectRef matches your Supabase project, and that callers cannot access another user’s threads (403).

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.

Edit this page on GitHub or file an issue.

Get started

Agent definition

Build and deploy

Add identity to Managed Deep Agents

Choose a path

Default: LangSmith API key

Project structure

Authenticate end users with Supabase

Test and deploy

​Choose a path

​Default: LangSmith API key

​Project structure

​Authenticate end users with Supabase

​Test and deploy

Choose a path

Default: LangSmith API key

Project structure

Authenticate end users with Supabase

Test and deploy