[docs] misc updates based on feedback by artberger · Pull Request #888 · agentgateway/website

artberger · 2026-08-12T13:01:50Z

source token in xaa
jwtSign
token types
tool calls

Signed-off-by: Art Berger <art.berger@solo.io>

cloudflare-workers-and-pages · 2026-08-12T13:47:52Z

Deploying agentproxy with Cloudflare Pages

Latest commit:	`7e56048`
Status:	✅ Deploy successful!
Preview URL:	https://4e6558c5.agentproxy.pages.dev
Branch Preview URL:	https://adb-fixes.agentproxy.pages.dev

View logs

Nadine2016 · 2026-08-12T16:41:23Z

+
+The gateway extracts tool calls from every response format that it supports, including streaming responses. For a streaming response, the gateway assembles the argument fragments from the individual chunks into one value when the stream ends, so a set of arguments that the provider splits across several chunks still arrives as one object.
+
+When a response carries no tool calls, the gateway omits the attribute from the log line completely, rather than recording an empty array. Filter for the attribute name to find the requests that used tools.


assuming this is true for traces also, but might be worth adding

Nadine2016 · 2026-08-12T16:41:55Z

+When a response carries no tool calls, the gateway omits the attribute from the log line completely, rather than recording an empty array. Filter for the attribute name to find the requests that used tools.
+
+> [!NOTE]
+> Reading `llm.toolCalls` has a performance cost for large responses, because the gateway inspects the response body. Add the attribute where the tool calls matter, rather than to every route.


I can't understand the second sentence

Nadine2016 · 2026-08-12T16:55:31Z

+          expression: jwt.id_token
+```
+
+The `jwt` variable holds the claims of the token that the JWT authentication policy validated, so an expression can read only a claim that arrived signed. The exchange runs on the extracted ID token, and the outer access token is never sent to either token endpoint.


not sure I understand what it means with outer access token

Nadine2016 · 2026-08-12T16:59:27Z

+
+### When the source yields no credential {#subject-token-empty}
+
+The gateway does not fall back to another location. If the configured source yields nothing, the request fails with a `400` and the message `invalid request`, and the gateway does not call the identity provider. The following cases all fail this way:


I feel like this could be summarized to 1 or 2 sentences and added further up where you explain how to set the source

Nadine2016 · 2026-08-12T17:13:36Z

   | `audiences`, `scopes`, `resources` | The `audience`, `scope`, and `resource` parameters sent to the token endpoint. `resources` are [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) resource indicators. |
-   | `subjectToken` | Where to read the incoming credential and its `tokenType` (`AccessToken`, `Jwt`, and so on). Defaults to the `Authorization: Bearer` header. |
-   | `actorToken` | Optional RFC 8693 delegation actor token (`TokenExchange` grant only). |
+   | `subjectToken` | Where to read the incoming credential and its `tokenType`, which is either a built-in name such as `AccessToken`, `Jwt`, or `IdToken`, or a custom absolute URI, as described in [Token types](#token-types). Defaults to the `Authorization: Bearer` header, with the type `AccessToken`. |


is accesstoken, jwt, etc the type of token and the authorization header is the source? if so maybe update that sentence.

Nadine2016 · 2026-08-12T17:41:22Z

+   | `ttl` | Optional token lifetime that the gateway uses for `exp`. Defaults to `300s`. |
+   | `location` | Optional location that the gateway writes the signed token to. Defaults to the `Authorization` header with a `Bearer` prefix. Set exactly one of `header`, `queryParameter`, or `cookie` to change it. At a custom location, the gateway writes the bare token with no `Bearer` prefix. |
+
+2. Only `signingKeyRef` is required. A policy that sets nothing else signs with `RS256` and a 300-second lifetime, and writes the token to the `Authorization` header.


not sure why this is a step

Signed-off-by: Art Berger <art.berger@solo.io>

Co-authored-by: Nadine Spies <nadinekipsch@onlinehome.de> Signed-off-by: Art <artberger@users.noreply.github.com>

Signed-off-by: Art Berger <art.berger@solo.io>

artberger added 7 commits August 11, 2026 10:23

wrap note that is upstream-only

f071a3c

Signed-off-by: Art Berger <art.berger@solo.io>

source token in xaa

37f2bda

Signed-off-by: Art Berger <art.berger@solo.io>

jwtSign and some fixes

7adb704

Signed-off-by: Art Berger <art.berger@solo.io>

token types for pe-861

32e7efe

Signed-off-by: Art Berger <art.berger@solo.io>

tool calls for pe-866

f42af01

Signed-off-by: Art Berger <art.berger@solo.io>

versioning

9326fe9

Signed-off-by: Art Berger <art.berger@solo.io>

cost catalog default note

c5a7a52

Signed-off-by: Art Berger <art.berger@solo.io>

artberger added this to the Docs for 1.5 milestone Aug 12, 2026

artberger self-assigned this Aug 12, 2026

artberger added documentation Improvements or additions to documentation agentgateway labels Aug 12, 2026