background gif
eni6ma

Integrate

Migration guide

Replace ambient credentials one endpoint at a time. Keep PKI and mTLS; change the authority object on the routes that hurt when stolen.

  1. 1. Inventory

    List APIs, agents, and MCP tools that hold long-lived secrets. Rank by blast radius if stolen (payment, admin, data export, side-effecting tools first).

  2. 2. Shadow mode

    Deploy Gate to observe envelope assembly and coverage while still accepting existing tokens. Measure missing proofs and client gaps without cutting over.

    Migration can run Gate in shadow mode (envelopes observed, tokens still accepted) before proof-required cutover.Design targetFour-stage path: inventory → shadow → proof-required on high-risk → retire tokens per endpoint.

  3. 3. Proof-required on high-risk

    Flip fail-closed on the top blast-radius routes. Confirm allow path and replay reject with the conformance suite before expanding the set.

  4. 4. Retire tokens per endpoint

    Remove the ambient credential for routes that are proof-required and stable. Leave coexistence on paths not yet migrated (see Security → Coexistence).