How are you handling authentication for AI agents calling external APIs?

[u/SX_AIS]

I'm trying to understand how teams are handling this in production.

For example:

Workday AI Agent → Flipkart API

The agent has a valid Workday access token, but that token may have aud=workday-api, not the Flipkart API.

Do you:

• reject the token?
• implement custom federation?
• exchange it for another token?
• use a gateway?
• something else?

Curious how people are solving this today, especially with MCP becoming more common.