For automated integrations (e.g., via the amaise SDK), the OAuth2 client credentials flow is used. Integration agents receive dedicated credentials and authenticate directly against the authentication service.

The issued access tokens are valid for 10 hours and are verified like all other tokens through JWT validation — including issuer whitelist and audience validation.

Integration agents receive their own technical role with defined permissions that follow the principle of least privilege. The same tenant-specific access restrictions apply as for interactive users.