Amazon Bedrock AgentCore adds Consent portal for AI agent OAuth

The Consent portal arrives as enterprises increasingly deploy AI agents that need to act on a user's behalf across services like GitHub and Slack. Previously, the three-legged OAuth flow required customers to build and host their own session binding infrastructure — presenting authorization URLs, hosting public HTTPS callbacks, managing browser sessions, and calling CompleteResourceTokenAuth. That was a significant engineering lift for what is essentially plumbing.

Now, administrators configure the corporate identity provider, gateway targets, execution role, and outbound providers, then share a single portal URL. End users sign in, review available services, and grant consent per provider. The portal handles redirects and session binding, while AgentCore Identity stores tokens in its vault, and subsequent tool calls use the stored token without repeated prompts.

The outcome hinges on whether the managed portal sufficiently reduces that setup burden for administrators. One portal is allowed per gateway, and the gateway can't be changed after creation, so choosing a clear, recognizable gateway name matters because it's visible to end users. Administrators should also watch for refresh token behavior: if no valid refresh token is available, users must return to reauthorize. Configuring providers to issue refresh tokens — for example, enabling user-to-server token expiration for GitHub or token rotation for Slack — is likely to smooth the ongoing experience.