Enterprise identity on Amazon Bedrock AgentCore with Lark (Feishu) as the IdP. Every turn arrives as a signed per-user JWT, and that user's Lark token lives in the AgentCore Identity Token Vault (OAuth 3LO) — stored and refreshed natively, no self-managed store. MCP tools act as the user against Lark, reaching only what that user can.
mcp feishu 3lo custom-jwt token-vault bedrock-agentcore agentcore-memory agentcore-runtime agentcore-identity lark-oauth enterprise-identity
-
Updated
Aug 25, 2026 - Python