> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/agent-privilege-guard/apono-agentic-gateway/deploy-the-remote-agentic-gateway.md).

# Deploy the Remote Agentic Gateway (BETA)

{% hint style="success" %}
**The Remote Agentic Gateway is currently available through a private beta program. Contact your Apono representative for setup information.**
{% endhint %}

The **Remote Agentic Gateway** connects AI clients to Apono through a shared HTTPS endpoint. It runs centrally as the proxy service of an Apono connector in your environment, so users do not need to install or run the gateway on their local machines. One deployment can serve multiple users and AI clients that can reach the endpoint.

***

### How the Remote Agentic Gateway works

1. The AI client connects to the gateway. The client sends MCP requests to `https://<HOSTNAME>/mcp`.
2. The ingress or load balancer routes the request. It terminates TLS and forwards HTTP traffic to the `<CONNECTOR_ID>-proxy` service on port `10020`.
3. The connector proxy brokers the request through Apono. The applicable agentic access flow governs temporary access, and the MCP’s intent policy governs the tool call. Credentials are not exposed to the AI model.
4. Apono records the activity. The agent and associated user appear in AI Agents, while AI Sessions records access grants, tool calls, and policy decisions.

One gateway deployment can support multiple users and AI clients that can reach the endpoint.

{% hint style="success" icon="lightbulb" %}
The Remote and Local Agentic Gateways provide the same Apono access controls. Only the deployment model differs. To run the gateway on each user’s machine instead, see [Install the Local Agentic Gateway](/docs/agent-privilege-guard/apono-agentic-gateway/install-the-local-agentic-gateway.md).
{% endhint %}

***

### Prerequisites

<table><thead><tr><th width="165.24609375">Item</th><th>Details</th></tr></thead><tbody><tr><td><strong>Private beta access</strong></td><td><p>Required program participation</p><p>Your organization is participating in the Remote Agentic Gateway private beta.</p></td></tr><tr><td><strong>Apono account setup completed</strong></td><td><p>Enablement of MCP feature for the Apono account</p><p>Confirm that an Apono admin has <a href="/pages/GSGlaa9WSevBnACrmAIt">set up Apono Agent Privilege Guard</a>:</p><ul><li>Enabled MCP features</li><li>Connected the applicable integration</li><li>Created an agentic access flow with <strong>Restrict to agentic access</strong> enabled</li><li>Enabled the corresponding Apono Managed MCP</li></ul></td></tr><tr><td><strong>Apono connector</strong></td><td><p>Connector deployment requirements</p><p>Confirm the following:</p><ul><li>You have access to install or upgrade an Apono connector using Kubernetes and Helm.</li><li>The Apono connector is version <strong>1.8.4+</strong>.</li><li>The <code>apono-connector</code> Helm chart is version <strong>2.1.4+</strong>.</li><li>For a new connector, obtain the connector ID and token from Apono.</li></ul></td></tr><tr><td><strong>DNS hostname</strong></td><td>Hostname for the gateway endpoint, such as <code>apono-agentic-gateway.&#x3C;your-domain></code></td></tr><tr><td><strong>TLS certificate</strong></td><td>Certificate that matches the hostname and is trusted by the AI client runtime</td></tr><tr><td><strong>Ingress or load balancer</strong></td><td>Endpoint that terminates HTTPS and forwards HTTP traffic to the connector proxy service on port <code>10020</code></td></tr></tbody></table>

#### Network requirements

<table><thead><tr><th width="166.72265625">Source</th><th width="293.28125">Destination</th><th>Port</th><th>Protocol</th></tr></thead><tbody><tr><td>AI client runtime</td><td>Remote Agentic Gateway HTTPS endpoint</td><td><code>443</code></td><td>HTTPS</td></tr><tr><td>Ingress or load balancer</td><td>Connector proxy service</td><td><code>10020</code></td><td>HTTP</td></tr><tr><td>Connector</td><td>Apono API</td><td><code>443</code></td><td>HTTPS</td></tr><tr><td>Connector</td><td>Integrated target systems</td><td>As required</td><td>As required</td></tr></tbody></table>

***

### Set up the gateway

#### Enable the connector proxy

Follow the steps:

1. Enable the connector proxy for a new or existing Apono connector.

{% tabs %}
{% tab title="New connector" %}
A dedicated connector is recommended for the Remote Agentic Gateway. This isolates gateway traffic from other connector workloads and requires no additional sizing beyond the Helm chart defaults.

Create the connector in Apono and obtain its connector ID and token. Then add the following configuration to a new **values.yaml** file.

{% code overflow="wrap" expandable="true" %}

```yml
apono:
  connectorId: <CONNECTOR_ID>
  token: <APONO_CONNECTOR_TOKEN>

proxyService:
  enabled: true
```

{% endcode %}
{% endtab %}

{% tab title="Existing connector" %}
You can reuse an existing connector when deploying a dedicated connector is not practical. Provide approximately one additional vCPU and 1.5 GB of memory for the agentic workload, then adjust the allocation based on actual usage.

Add the following configuration to the connector’s existing **values.yaml** file. Do not replace its other settings.

{% code overflow="wrap" expandable="true" %}

```yml
proxyService:
  enabled: true
```

{% endcode %}
{% endtab %}
{% endtabs %}

{% hint style="warning" %}
The gateway connector must run as a single replica. Multiple replicas can route requests from the same session to different connector instances, resulting in `unknown session` errors.
{% endhint %}

2. Install the new connector or upgrade the existing connector using your Helm deployment process.
3. Confirm that the `${CONNECTOR_ID}-proxy` service appears. The service exposes the gateway internally over HTTP on port `10020`.\
   \
   If the service does not appear, confirm that `proxyService.enabled` is set to `true`, and then reinstall or upgrade the connector.

{% code overflow="wrap" expandable="true" %}

```shellscript
kubectl get svc -n ${NAMESPACE} ${CONNECTOR_ID}-proxy
```

{% endcode %}

#### Expose the connector proxy over HTTPS

Expose the `${CONNECTOR_ID}-proxy` service through an ingress or load balancer that:

* Accepts HTTPS connections from AI client runtimes
* Uses a certificate that matches the gateway hostname
* Terminates TLS
* Forwards HTTP traffic to `${CONNECTOR_ID}-proxy` on port `10020`

The following example uses an AWS Application Load Balancer ingress on Amazon EKS.

Follow these steps:

1. Create an **ingress.yaml** file with the following configuration. Be sure to replace the placeholder values listed below.

{% hint style="info" %}
This example creates an internal load balancer. Use an internet-facing endpoint only when required by your AI client and network architecture.

The unauthenticated / path can return `401` or `404` when the gateway is healthy. The ALB health check therefore accepts status codes from `200` through `499`.
{% endhint %}

{% code overflow="wrap" expandable="true" %}

```yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apono-agentic-gateway
  namespace: <NAMESPACE>
  annotations:
    alb.ingress.kubernetes.io/scheme: internal              # internal LB; use internet-facing only if required
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: <ACM_CERT_ARN>   # cert matching <HOSTNAME>
    alb.ingress.kubernetes.io/backend-protocol: HTTP        # HTTP to the connector (TLS already terminated)
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
    alb.ingress.kubernetes.io/healthcheck-port: traffic-port
    alb.ingress.kubernetes.io/healthcheck-path: /
    alb.ingress.kubernetes.io/success-codes: "200-499"      # IMPORTANT: '/' returns 401/404 without auth - that is healthy
    external-dns.alpha.kubernetes.io/hostname: <HOSTNAME>
spec:
  ingressClassName: alb
  rules:
    - host: <HOSTNAME>
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: <CONNECTOR_ID>-proxy
                port:
                  number: 10020


```

{% endcode %}

<table><thead><tr><th width="154.921875">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;NAMESPACE></code></td><td>Namespace where the connector is installed</td></tr><tr><td><code>&#x3C;CONNECTOR_ID></code></td><td>ID of the connector running the gateway</td></tr><tr><td><code>&#x3C;ACM_CERT_ARN></code></td><td>ARN of the AWS Certificate Manager certificate matching the hostname</td></tr><tr><td><code>&#x3C;HOSTNAME></code></td><td>DNS hostname assigned to the gateway</td></tr></tbody></table>

2. Provision the ingress or load balancer using your existing deployment process.
3. Configure DNS and TLS:
   * Point `<HOSTNAME>` to the load balancer using an `A` or alias record.
   * If ExternalDNS is not configured, remove the `external-dns.alpha.kubernetes.io/hostname` annotation and create the record manually after the load balancer is provisioned.
   * Confirm that the certificate matches `<HOSTNAME>` and is trusted by the AI client runtime.

#### Register the endpoint in Apono

Follow these steps:

1. On the [**Connectors**](https://app.apono.io/connectors) tab, in the row of the connector used for the Remote Agentic Gateway, click **︙> Edit**. The **Edit Connector** page opens.
2. Click the **Enable Agentic Proxy** toggle. The **Agentic Proxy Exposed Hostname** field appears.
3. Enter the **Agentic Proxy Exposed Hostname**.

{% hint style="warning" %}
Only enter the hostname, such as *apono-agentic-gateway.\<your-domain>*. Do **not** include the protocol (*https\://*) or the */mcp* path.
{% endhint %}

4. Click **Update Connector**. The connector is updated. The **Connectors** tab opens.

#### Validate the gateway endpoint

Run the following checks from a machine that can reach the gateway endpoint, which is typically internal.

Follow these steps:

1. Confirm that the `${CONNECTOR_ID}-proxy` service exists.

{% code overflow="wrap" expandable="true" %}

```shellscript
kubectl get svc -n ${NAMESPACE} ${CONNECTOR_ID}-proxy
```

{% endcode %}

2. Confirm that the ingress or load balancer is provisioned and routes traffic to `${CONNECTOR_ID}-proxy` on port `10020`.

{% code overflow="wrap" expandable="true" %}

```bash
kubectl get ingress -n ${NAMESPACE}
```

{% endcode %}

3. Confirm that `${HOSTNAME}` resolves to the ingress or load balancer.

{% code overflow="wrap" expandable="true" %}

```bash
nslookup ${HOSTNAME}
```

{% endcode %}

4. Verify the HTTPS endpoint.

{% tabs %}
{% tab title="OAuth protected-resource metadata" %}
Request the OAuth protected-resource metadata. A `200` response with a JSON body confirms that DNS, TLS termination, load-balancer routing, the Kubernetes service, and the connector proxy are connected.

{% code overflow="wrap" expandable="true" %}

```bash
curl -sS https://${HOSTNAME}/.well-known/oauth-protected-resource
```

{% endcode %}
{% endtab %}

{% tab title="MCP endpoint" %}
Request the MCP endpoint without credentials. A `401` response confirms that the request reached the gateway and requires authentication.

A timeout, connection refusal, or TLS error indicates a networking or certificate problem.

{% code overflow="wrap" expandable="true" %}

```bash
curl -i https://${HOSTNAME}/mcp
```

{% endcode %}
{% endtab %}
{% endtabs %}

#### Connect an AI client

Configure a supported AI client to connect to *https\://\<HOSTNAME>/mcp*.

Apono will provide client-specific configuration and authentication instructions to Remote Agentic Gateway private-beta participants.

***

### Troubleshoot the Remote Agentic Gateway

<details>

<summary><strong>The <code>${CONNECTOR_ID}-proxy</code> service does not appear.</strong></summary>

Follow these steps:

1. Confirm that `proxyService.enabled` is set to `true` in the connector’s **values.yaml** file.
2. Install the new connector or upgrade the existing connector again.
3. Confirm that the proxy service appears.

{% code overflow="wrap" expandable="true" %}

```bash
kubectl get svc -n ${NAMESPACE} ${CONNECTOR_ID}-proxy
```

{% endcode %}

</details>

<details>

<summary><strong>The load balancer marks the target as unhealthy.</strong></summary>

Configure the load-balancer health check to:

* Use `/` as the health-check path.
* Accept status codes from `200-499`.

The unauthenticated / path can return `401` or `404` when the gateway is healthy.

</details>

<details>

<summary><strong>The <code>curl</code> request hangs or the connection is refused.</strong></summary>

Confirm that the ingress or load balancer:

* Routes traffic to the `${CONNECTOR_ID}-proxy` service.
* Forwards traffic to port `10020`.

Also confirm that the applicable firewall rules, security groups, routing, and network policies allow the connection.

</details>

<details>

<summary><strong>The <code>curl</code> request returns a TLS error.</strong></summary>

Confirm that the TLS certificate:

* Matches `<HOSTNAME>`.
* Is presented by the ingress or load balancer.
* Is trusted by the AI client runtime.

</details>

<details>

<summary><strong>Agents intermittently receive an <code>unknown session</code> error.</strong></summary>

Confirm that the gateway connector runs as a single replica. If the connector is running multiple replicas, scale it back to one.

</details>

<details>

<summary><strong>The gateway is reachable, but all agent actions are denied</strong></summary>

Confirm with an Apono admin that the Apono account setup is complete:

* MCP features are enabled.
* The applicable integration is connected.
* An agentic access flow exists with **Restrict to agentic access** enabled.
* The corresponding Apono Managed MCP is enabled.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apono.io/docs/agent-privilege-guard/apono-agentic-gateway/deploy-the-remote-agentic-gateway.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.