[nkanu17]

Summary

• The self-managed auth page told operators to use api://redis-iris as the Data Plane's sign-in audience. The Data Plane now refuses to start with that value, so following the docs would break a deploy.
• This PR switches the example to api://context-gateway-dp, explains why the shared audience is unsafe, and adds a short upgrade path for deployments already on it.
• The developer MCP page and the chart upgrade steps each get one line about the change.
• Nothing else in the latest iris, redis-iris or cloud-ui changes touches the Gateway docs. No new redis-iris release exists, so the 1.0.0b2 pins stay.

Iris UI token          aud = api://redis-iris          opens Agent Memory, Playbook, Gateway Control Plane
MCP client token       aud = api://context-gateway-dp  opens the Gateway Data Plane only
Data Plane configured with audience api://redis-iris   refuses to start

Changes

Data Plane sign-in audience

Driven by redislabsdev/iris#2203 (MOD-20266, "Give Context Gateway MCP sign-in its own audience").

The Data Plane's validateOIDC now refuses auth.oidc.audience: api://redis-iris (context-gateway/dataplane/internal/infrastructure/config.go, sharedIrisAudience). The shared audience would let an MCP client's token open Agent Memory and Playbook too. The Helm README and values.yaml now say to register a separate API, for example api://context-gateway-dp, and the README carries an upgrade note. The spec docs/specs/MOD-19226-context-gateway-mcp-oauth-sign-in.md adds api://redis-iris to S10 and A2.

• content/operate/iris/context-gateway/self-managed/authentication.md
  • The audience row now uses api://context-gateway-dp and says not to use api://redis-iris.
  • New paragraph: register a separate API (a second app registration on Entra ID), why the shared audience is unsafe, that the Data Plane refuses it, that a renamed shared audience can't be detected, and not to give MCP clients the shared audience or its scope.
  • New ### Upgrade from the shared audience section, matching the Helm README note: register the API and assign roles, set dataplane.config.auth.oidc.audience, upgrade, then MCP clients sign in again.
• content/develop/ai/context-engine/context-gateway/mcp.md: one line in "Sign in with your identity provider" saying the token must be for the Gateway's own API, and a token for the shared Iris audience alone doesn't open a Gateway.
• content/operate/iris/context-gateway/self-managed/operations.md: one line in "Upgrade the chart" pointing at the new upgrade section.

The Control Plane and Iris UI examples keep api://redis-iris. The Helm README still uses it for controlplane.config.auth.oidc and the UI sso.audience.

Checked, no docs change

• Other iris changes since 9b1fd51 that touch context-gateway/: Fixed broken relrefs #2325 moves the trace attribute names into a shared package with the same values, and OP: add RediSearch v2.8.31 and v2.10.24 release notes #2324 changes the cloud Neptune charts only. Neither affects the self-managed or developer pages.
• redislabsdev/iris#2287 (redis-iris umbrella, global.iris only input): the umbrella doesn't include Context Gateway, and the Identity Service chart notes say nothing changes without global.iris. The Gateway deploy page installs Identity Service standalone, so it still holds.
• redis/redis-iris#85 (MOD-20478, CLI accepts and teaches NAMESPACE__TOOL): the Gateway docs have no dotted-name caveat to remove. The quickstart's CLI example calls scheduling__filter_provider in full mode, which 1.0.0b2 already sends unchanged. The fix ships in the next release.
• redis/redis-iris#83 (CLI input hardening): no documented CLI message or behaviour changes. The --write-env description (mode 0600, key never printed) still holds.
• PyPI redis-iris: latest is still 1.0.0b2 (2026-10-30), so the pinned versions stay. The "CLI rejects --jsonpath with --group-by" note also stays, since main hasn't changed that.
• cloud-ui 1c8e7ba4..6d9dc672: no Context Gateway files changed.

Overlap with #4419

#4419 doesn't touch authentication.md or mcp.md. It edits the "Upgrade the chart" section of operations.md a few lines above the new pointer, and git merge-tree merges the two cleanly.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only updates; no runtime or configuration behavior changes in this PR.

Overview
Documentation now matches the Data Plane refusing api://redis-iris as the MCP OIDC audience (MOD-20266). Operators and developers are told to register a Data Plane–only API (for example api://context-gateway-dp), not the shared Iris audience used by the console and Control Plane.

On authentication, the audience table row and new guidance explain why a shared audience would let MCP tokens reach Agent Memory and Playbook, that startup fails with api://redis-iris, and that dual-audience tokens are unsafe. A new Upgrade from the shared audience section lists IdP registration, config change, chart upgrade, and client re-sign-in.

MCP adds one sentence that IdP tokens must target the Gateway API. Operations → Upgrade the chart warns to migrate audience before upgrading when sign-in still uses the shared value.

^{Reviewed by Cursor Bugbot for commit 506122d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T18:47:21.470795Z	506122d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Staging links:
https://redis.io/docs/staging/MOD-20266/gateway-docs-own-audience/develop/ai/context-engine/context-gateway/mcp/
https://redis.io/docs/staging/MOD-20266/gateway-docs-own-audience/operate/iris/context-gateway/self-managed/authentication/
https://redis.io/docs/staging/MOD-20266/gateway-docs-own-audience/operate/iris/context-gateway/self-managed/operations/

[github-actions]

🧠 Redis Memory

Found 5 related items from repository history (5 new this commit):

• PR — RED-220418: Document per-Gateway result cache and handle settings 🆕

  Summary

• PR — MOD-20222: Align Context Gateway docs with the GA contract 🆕

  Summary

• PR — Iris docs: GA consistency pass on the 1.0 release and CLI 🆕

  Part of the GA pass for Redis Iris GA docs #4400. It brings iris-ga-docs in line with the 1.0 release and the current redis-iris CLI.

• PR — RED-220418: Add Context Gateway developer docs 🆕

  Summary

• PR — Iris docs: align with redis-iris SDK and CLI (MOD-20269) 🆕

  Aligns the Iris product docs on iris-ga-docs with the unified redis-iris SDK and CLI (main @ f4e76ef, 0.1.0a6). Part of MOD-20269(ht

Memory updated at 506122d