One auth to rule them all: how Zerq lets AI tools use the same credentials as your apps
Stop issuing separate AI keys and shadow routes. Zerq aligns MCP clients with the same client ID, profile, and gateway tokens as REST—one lifecycle, one audit trail, one rate-limit story.
- mcp
- ai
- security
- api-management
The title is deliberately provocative: there is not literally one password for everything in your enterprise. There should be one governed story—who the caller is, which API products they may use, and how those credentials are issued, rotated, and revoked. When AI tools use different keys than your apps, you inherit dual IAM, dual logs, and dual incident response—and you will ship exceptions faster than you can audit them.
Zerq’s model is simple to state: MCP clients use the same gateway context as REST clients—client ID, profile (for example sandbox versus production), and the profile credential material you already manage. No separate “AI gateway” product and no second class of secrets for assistants unless you choose that complexity.
The anti-pattern: parallel credentials
Common pilot patterns we see:
- A service account key checked into a repository for “the Copilot integration.”
- A vendor-supplied API key that bypasses your gateway for latency reasons.
- A shared Bearer token embedded in prompt templates (please never do this).
Each creates a credential lifecycle outside your standard IAM reviews and a logging prefix your SOC does not monitor.
What “same credentials” means in Zerq
Same client and profile
Partners and internal apps already think in terms of which application client they are and which environment profile they run against. Gateway MCP requests carry that same context in headers—so authorization maps to the same API products and scopes you enforce for ordinary HTTP traffic.
Same enforcement and observability
Rate limits, structured logs, and metrics are not optional add-ons for “AI traffic.” They apply to the same routes because the request hits the same gateway pipeline. Compliance gets one narrative—see Audit trails in the age of AI.
Management is different on purpose
Operators who change collections, proxies, or workflows should not use consumer credentials. Management MCP runs under your control-plane identity model (OIDC sessions or approved automation identities)—same RBAC as the admin UI, same audit log. That is still one auth model, but with different roles than an external partner. See Platform automation.
Comparison at a glance
| Topic | Parallel AI keys | Zerq unified path |
|---|---|---|
| Identity object | Ad-hoc service users | Client + profile you already issue |
| Audit | Fragmented or missing | Same logs as REST |
| Rate limits | Often forgotten for pilots | Same quotas as other callers |
| Revocation | Unknown blast radius | Revoke profile or credential once |
Why MCP does not change the authz truth
The Model Context Protocol standardizes how tools are listed and called; it does not magically know your tenant model. Authorization remains a gateway concern: if a tool should not run, it must fail at policy boundaries you own. Zerq aligns with that by routing execution through the same runtime as non-MCP traffic—Why your AI gateway needs the same security rules as your REST APIs expands the argument.
Zerq Copilot: same surfaces, conversational UX
Zerq Copilot uses the same MCP surfaces—Management MCP for operators and Gateway MCP for portal consumers—under server-side LLM configuration and your identity session. Credentials for models stay off the browser; gateway context stays tied to the right principal. See Zerq Copilot.
When you still need separate keys
You should still separate secrets by risk class—for example production versus sandbox, human versus automation, read versus admin. The goal is not one key per planet; it is no unreviewed shadow keys for AI because “the demo needed something fast.”
Summary: Unified auth for AI means the same gateway identity and policy objects you already operate—not a second integration lifestyle. Zerq implements that by design for Gateway MCP, Management MCP, and Copilot.
Request an enterprise demo to map your existing clients and profiles to MCP clients without new credential sprawl.