OAuth for AI Agents: Scoping Tokens So an Agent Can Only Do Its Job

Most CRM integrations still run on a single long-lived API key copied into a config file. That was tolerable for a nightly sync job. It is not for an agent that decides at runtime what to do. Here is how token design should change.

What a token for an agent must carry

Principal: which agent, distinct from any human.
Owner: which person is accountable.
Scope: which workspace and which actions.
Ceiling: the maximum set of actions, whatever the agent is asked to do.
Expiry: short enough that a leaked token has limited value.

Why OAuth fits

OAuth 2.1 with the client-credentials or device flow gives you issued, scoped, revocable, expiring tokens with a standard refresh mechanism. The MCP specification describes OAuth-based authorisation, and a growing number of clients support it, so a user can connect an assistant without handling a raw key.

AI PRO CRM does not use OAuth today. Each agent gets its own static bearer credential, sent as Authorization: Bearer aiprocrm_ag_..., with an expiry of 30, 90, 180 or 365 days, and rotation and immediate revocation per agent. Instead of per-token scopes, the agent's preset sets its ceiling: Analyst is read-only, and Assistant and Operator can also add internal notes to companies.

Token formats

Opaque tokens looked up server-side are simpler to revoke than self-contained JWTs, because revocation takes effect on the next lookup. AI PRO CRM uses opaque agent credentials, shown once and stored only as a SHA-256 hash, so a database leak does not reveal usable tokens. Never embed tenant or role information the client could tamper with.

Rotation and revocation

Rotate on a schedule and on any suspicion. Allowing several active credentials per agent (AI PRO CRM allows up to three) lets you rotate without downtime.
Record failed authentication attempts. In AI PRO CRM, the agent call ledger records an auth_failed status, and repeated failures with an old credential suggest it was copied somewhere it should not be.
Tie credentials to the agent's status, so disabling an agent stops them all at once.

Do not put tokens in prompts

It is tempting to give a language model its own credentials in the system prompt so it can "call the API". Do not. Tokens belong in the runtime that executes tool calls, never in text the model could be tricked into repeating.

FAQ

Can an agent request more scope at runtime?
It should not. In AI PRO CRM an agent's permissions come from its preset, which is set by people in the workspace, never by the agent itself.

What about agents created by ordinary team members?
Every agent should carry an accountable owner. In AI PRO CRM that owner must be an active member of the workspace.

Does AI PRO CRM support OAuth for agents?
No. Agents authenticate with per-agent bearer credentials that expire, can be rotated and can be revoked immediately.