Use OIDC or bound act-as - Dome

This tutorial is coming soon.

Govern per end user teaches the pattern with HMAC: your backend holds the agent token, signs X-Dome-Act-As, and calls Dome. The frontend never sees either secret. Production usually should not mint identities with a shared HMAC secret. This tutorial will cover the two stronger verification methods:

Method	When to use	What the backend sends
OIDC	End users sign in through your IdP	The end-user JWT as `X-Dome-Act-As`. Dome verifies it against discovery metadata
Bound	The agent is enrolled to one person	No client act-as header. The platform injects the enrollment identity

Until this tutorial ships, use the HMAC sandbox path and the delegated-agent reference below.

Next steps

Until this tutorial ships, use the HMAC path and the delegated-agent reference:

Govern per end user for the HMAC sandbox path
Delegated agents for OIDC providers, workspace policy, and methods
Pass identity for delegated agents in application code
Adopt an existing app to move a running app onto the governed path

⌘I