> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal):
> ```bash
> npx -y @scalekit-inc/cli setup -y
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup -y
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`.
> Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Manage Agent Gateway users and access

Add people to Agent Gateway, sign them in with SSO and SCIM, group them, and choose which connections and tools each group can use.
Agent Gateway decides what each person's AI client can do in two steps: who can sign in, and which tools each group can use on each connection. You manage both in the dashboard, under **Identity**, **Groups** and each connection's **Policies** tab.

> note: Available on request
>
> Agent Gateway is available on request. [Contact us](/support/contact-us/) to enable it for your
> workspace.

## Add users

Only Gateway users can sign in to the Gateway. You become one when you enable it. To add someone else:

1. In Agent Gateway, open **Identity**, then the **Users** tab.
2. Select **Create User** and enter their email address.

They get access straight away, with no invitation email. They can then [connect their AI client](/agentkit/agent-gateway/connect-ai-clients/).

### Sign users in with your identity provider

To manage users from your company's identity provider, such as Okta or Microsoft Entra ID, use the other two tabs in **Identity**:

- **SSO**: users sign in to the Gateway through your identity provider.
- **SCIM**: your identity provider syncs its users and groups to the Gateway. Synced groups appear under **Groups**.

## Group users and choose their tools

**Groups** decide which connections and tools a person can use. Every user is in the built-in **Everyone** group. You can add manual groups, and groups synced from your identity provider through SCIM appear there too. On each connection's **Policies** tab, you grant groups all tools, only the tools you allow or all tools except the ones you block.

[Access policies](/agentkit/agent-gateway/access-policies/) walks through creating groups and grants with screenshots, explains how grants combine and has recipes for common setups.

## Next

Create groups and choose which tools each one can use in [Access policies](/agentkit/agent-gateway/access-policies/).


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |