---
title: "Configure managed identity"
description: "Prepare a production domain and configure phone or enterprise authentication."
image: "https://help.agent.mq/og.svg"
---

> Documentation Index
> Fetch the complete documentation index at: https://help.agent.mq/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure managed identity

Managed identity separates the application's production sign-in environment from Agent and service credentials.

## Production domain lifecycle

1. `POST /v1/applications/{appId}/identity/production` prepares the customer-owned domain.
2. `POST /v1/applications/{appId}/identity/production/check` checks DNS and certificate state.
3. `POST /v1/applications/{appId}/identity/production/activate` switches managed login only after verification.

Each write carries a stable `idempotencyKey`. Creating the production instance and enabling usage-billed authentication also require `billingAcknowledged` where the schema says so.

## Authentication methods

- `PUT /identity/phone-authentication` enables or disables usage-based SMS authentication.
- `PUT /identity/enterprise-connections/{connectionId}` creates or updates an OIDC or SAML connection.
- `POST /identity/enterprise-connections/{connectionId}/test` creates a short-lived test link.
- `DELETE /identity/enterprise-connections/{connectionId}` removes the production connection.

## Boundaries

Identity configuration never returns a client secret. Domain activation does not grant an Agent access to application operations, and application Agent keys do not administer identity.

## See also

- [Application model](/getting-started/application-model)
- [Authentication matrix](/reference/authentication)

Source: https://help.agent.mq/build/managed-identity/index.mdx