--- title: Configuring AI gateways description: The PingOne Privilege AI Gateway secures AI-agent interactions. component: privilege page_id: privilege:agent-privilege:configuration/ai-gateways canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/ai-gateways.html llms_txt: https://docs.pingidentity.com/privilege/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: September 12, 2026 page_aliases: ["agent-privilege:mcp-gateway.adoc"] section_ids: configure-an-ai-gateway-using-the-setup-wizard: Configure an AI gateway using the setup wizard before-you-begin: Before you begin steps: Steps next-steps: Next steps configure-an-ai-gateway-using-docker: Configure an AI gateway using Docker before-you-begin-2: Before you begin steps-2: Steps result: Result --- # Configuring AI gateways The PingOne Privilege AI Gateway secures AI-agent interactions at a single enforcement point. It authenticates every caller, enforces policy at the tool, model, and agent boundaries, and injects backend credentials at runtime so agents never hold them. Every request and response is inspected for AI-specific threats, and all interactions are recorded in one audit trail. PingOne Privilege allows you to add an AI gateway using a setup wizard or through Docker. ## Configure an AI gateway using the setup wizard ### Before you begin * In the PingOne admin console, create an OIDC web application. For instructions, refer to [Creating a web application](https://docs.pingidentity.com/pingone/applications/p1_mfa_creating_a_web_application.html) in the PingOne documentation. * Before you add an AI gateway, create a new Virtual Machine (VM) to deploy the proxy container. Ensure the VM meets the required specifications for optimal performance and connectivity: * **CPU**: 2 cores, sufficient for processing proxy operations efficiently. * **RAM**: 4 GB ensures smooth container operation. * **Storage**: 20 GB accommodates system files and application data. * **Firewall Policy**: * **Outbound**: Allow all traffic. * Supported Operating Systems: * `RHEL / CentOS (RPM x86_64)` * `Debian / Ubuntu AMD64` * `Debian / Ubuntu ARM64` ### Steps To add an AI gateway using the setup wizard: 1. In the PingOne Privilege admin console, go to **Directory > Gateways**. 2. Click **Add New**, and then click **Add via Wizard**. 3. Review the requirements for your VM, then click **Next**. 4. Install Docker based on the official [Docker installation guide for your OS](https://docs.docker.com/engine/install/). 5. Verify Docker is running using the following command in your CLI: `sudo docker ps` If the command runs without errors, Docker is installed and running successfully. 6. Select **AI Gateway** as your deployment mode. Click **Next** 7. Enter a unique **AI Gateway Name** to identify the AI gateway. 8. Enter the **FQDN / Host IP** of the server where the AI gateway is installed. 9. Click **Next**. 10. Enter the following fields: * **AI Gateway Server** fields: * **Gateway URL**: FQDN from the VM. | | | | - | ------------------------------------------ | | | This URL must have `:8623` appended to it. | * **Cert Path**: Filled by default. * **(Optional)**: **Redis URL**: Point the Gateway to your Redis URL. * Fill in the following fields with information from the OIDC app created in PingOne: * **Client ID** * **Client Secret** * **Auth URL** * **Token URL** * **User Info URL** * **User ID Claim** 11. Click **Next**. 12. Create the environment file with the following commands: 1. To create the directory, if not already present: `sudo mkdir -p /var/lib/procyon` 2. To create the file and open it: `sudo vi /var/lib/procyon/procyon-guest-agent.env` 3. Copy the generated content from your setup tasks and paste it inside the newly created file and save it. 4. In the setup wizard, click **Next**. 13. Select your operating system from the list. Click **Show Instructions** for the detailed steps for installing the package for your operating system. 14. Click **Finish**. ### Next steps After adding the gateway, go to the **Directory > Gateways** page in the admin console. Your new AI gateway should be listed with a `Verified` status. ## Configure an AI gateway using Docker ### Before you begin * In the PingOne admin console, create an OIDC web application. For instructions, refer to [Creating a web application](https://docs.pingidentity.com/pingone/applications/p1_mfa_creating_a_web_application.html) in the PingOne documentation. * Ensure the following inbound ports are open on the host where you will install the Gateway Mesh Cluster: * `8623`: AI clients to AI Gateway * `8680`: Endpoint Controller to AI Gateway * `8690`: Gateway to Gateway - Mesh Cluster ### Steps To add an AI gateway with Docker: 1. In the PingOne Privilege admin console, go to **Directory > Gateways**. 2. Click **Add New**, and then click **Add via Docker**. 3. Select **AI gateway**. 4. To generate a Docker command, fill in the following fields with information from the OIDC app created in PingOne: * **Cluster ID** * **Host IP** * **AI Gateway Server URL** * **OIDC Client ID** * **OIDC Client Secret** * **OIDC Auth URL** * **OIDC Token URL** * **OIDC User URL** * **User ID Claim** 5. Click **Get Docker Command**. 6. Click **Copy Docker Command** to copy the command to your clipboard. 7. On your designated host within your on-premise network, run the Docker command you just copied. **Result:** The gateway will start and automatically register with the AI gateway. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | The Endpoint Controller doesn't have automatic visibility into on-premises network topology. After deploying the gateway, you must manually configure which resources are accessible through it. | ### Result Your new AI gateway should be listed with a `Verified` status on the **Directory > Gateways** page.