Comment by kdodhia

Not today, no. Right now it's TLS plus the agent's Alter key, and every request is signed with that key. Each signature is timestamped and single use, so a captured request can't be replayed or tampered with. You can also lock a key to specific IP ranges, scope it down to just what that agent needs, and give it an expiry, so a leaked key is pretty limited in what it can do and where from. mTLS is a fair ask though, especially for people running agents in their own infra, and it's something we'd look at adding