# Golem Add HTTP Auth Rust

> Enabling authentication on Rust HTTP endpoints. Use when the user asks to add auth, require authentication, or protect HTTP endpoints.

- Skill: `golemcloud/golem-add-http-auth-rust` (Agent Skill)
- Install (CLI): `npx skillmds@latest add golemcloud/golem-add-http-auth-rust`
- Raw SKILL.md: https://api.skillmd.com/api/skills/golemcloud/golem-add-http-auth-rust/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: golemcloud (https://skillmd.com/u/golemcloud)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/golemcloud/golem-add-http-auth-rust

---


# Enabling Authentication on Rust HTTP Endpoints

## Overview

Golem supports authentication on HTTP endpoints via OIDC providers. Authentication is enabled in the agent code and configured via security schemes in `golem.yaml`. Load the `golem-configure-api-domain` skill for details on setting up security schemes and domain deployments, including when to use `subdomain` versus `domain`.

## Enabling Auth on All Endpoints (Mount Level)

Set `auth = true` on `#[agent_definition]` to require authentication for all endpoints:

```rust
#[agent_definition(mount = "/secure/{name}", auth = true)]
pub trait SecureAgent {
    fn new(name: String) -> Self;
    // All endpoints require authentication
}
```

## Enabling Auth on Individual Endpoints

Set `auth = true` on specific `#[endpoint]` attributes:

```rust
#[agent_definition(mount = "/api/{name}")]
pub trait ApiAgent {
    fn new(name: String) -> Self;

    #[endpoint(get = "/public")]
    fn public_data(&self) -> String;

    #[endpoint(get = "/private", auth = true)]
    fn private_data(&self) -> String;
}
```

## Overriding Mount-Level Auth

Per-endpoint `auth` overrides the mount-level setting:

```rust
#[agent_definition(mount = "/api/{name}", auth = true)]
pub trait MostlySecureAgent {
    fn new(name: String) -> Self;

    #[endpoint(get = "/health", auth = false)]
    fn health(&self) -> String; // No auth required

    #[endpoint(get = "/data")]
    fn get_data(&self) -> Data; // Auth required (inherited)
}
```

## Deployment Configuration

After enabling `auth = true` in code, you must configure a security scheme in `golem.yaml`. Load the `golem-configure-api-domain` skill for the full details, including when to use `subdomain` versus `domain`. Quick reference:

```yaml
httpApi:
  deployments:
    local:
    - subdomain: my-app  # resolves to my-app.localhost:9006 by default
      agents:
        SecureAgent:
          securityScheme: my-oidc            # For production OIDC
        # or for development:
        # SecureAgent:
        #   testSessionHeaderName: X-Test-Auth
```