For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Understand why SAP AI Core models do not run on kagent 1.0, and what to use instead.

The SAPAICore provider does not run on kagent 1.0. SAP AI Core authenticates with OAuth2 client credentials, which a client exchanges at a token endpoint for a short-lived access token before it calls the API. An agent reaches its model provider through the Agent SubstrateAgent SubstrateThe runtime that kagent runs agents on. It multiplexes many sandboxed Actors onto a smaller pool of pre-started Workers, suspending idle ones to snapshots.Learn more egress gateway, which injects a static credential into an HTTP header and performs no token exchange, so kagent rejects a SAP AI Core ModelConfigModelConfigA Kubernetes custom resource naming one model at one provider, along with the credentials to reach it. An AgentTemplate references one by name, and every agent compiled from that template calls the model that it names.Learn more rather than passing the client secret to the runtime.

The rejection happens at compile time on every runtime. The AgentTemplate reports the Compatible condition as False with the reason UnsupportedConfiguration, and kagent compiles no revision from it.

environment credential "SAP_AI_CORE_CLIENT_ID" cannot use gateway header injection; local signing and arbitrary secret environment variables are unsupported

The error names SAP_AI_CORE_CLIENT_ID, but a Secret reaches that check only when it already holds the keys client_id and client_secret under exactly those names. A Secret that names them anything else fails earlier, on the ModelConfig’s ResolvedRefs condition, with secret <name> does not contain key "client_id". SAPAICore is also the one provider that ignores apiKeySecretKey, because kagent reads both keys from the Secret that apiKeySecret names. Neither detail changes the outcome, and both decide which error a reader sees first.

Reach the same models another way

The SAP AI Core Orchestration Service serves models from several families, and kagent supports most of those families directly through a provider that authenticates with an API key. Choose the provider for the model that you want to run, rather than for the gateway that serves it.

For every credential that the gateway cannot inject, and the alternative for each, see About model providers.

Next steps