Configurable - Copilotkit

Choose the right channel

Some LangGraph adapters merge browser-supplied forwardedProps.config into LangGraph's RunnableConfig. Those values remain browser-controlled and untrusted, even when a LangGraph config schema accepts them. Never use them for credentials, tenant identity, authorization, or server execution controls. Keep the trust boundary explicit and use the channel that matches the value:

Value	Supported channel
UI preferences the model should see	Publish them with your frontend's agent-context API; see Agent Config.
Authentication and authorization	Send an `Authorization` header and validate it for every request; see Authentication.
Graph execution settings	Set them in the trusted backend that invokes or serves the graph.

<Callout type="warning" title="Do not send credentials as run properties"> Run properties are application payload, not an authentication or LangGraph configuration channel. Validate credentials at the server boundary and pass only the resolved identity to the graph. </Callout>

Model-visible UI preferences

For tone, expertise level, response length, selected records, or other non-secret values that should influence the model, publish them as agent context. The Agent Config guide shows the complete pattern and how CopilotKit middleware exposes the latest values on every turn.

<FrontendOnly frontend="react"> In React, publish the values with [`useAgentContext`](/reference/v2/hooks/useAgentContext). </FrontendOnly> <FrontendOnly frontend="angular"> In Angular, publish the values with [`connectAgentContext`](/reference/angular/functions/connectAgentContext). </FrontendOnly>

Authentication

Authentication belongs in request headers, not graph state or runtime properties. The Authentication guide covers both LangGraph Platform and self-hosted AG-UI endpoints. In both cases, validate the current request before the graph runs and inject only a resolved user or tenant identifier.

Trusted graph execution settings

Set graph configuration in backend code after validating any input that influences it. Do not accept a browser-supplied configuration object wholesale.

<Tabs groupId="language_langgraph_agent" items={['Python', 'TypeScript']} default="Python" persist> <Tab value="Python"> For a self-hosted AG-UI endpoint, construct a request-local LangGraphAGUIAgent with backend-owned configuration:

```python title="main.py"
from copilotkit import LangGraphAGUIAgent

def build_agent(tenant_id: str) -> LangGraphAGUIAgent:
    return LangGraphAGUIAgent(
        name="sample_agent",
        description="Tenant-scoped agent",
        graph=graph,
        config={
            "configurable": {"tenant_id": tenant_id},
            "recursion_limit": 50,
        },
    )
```

A node can then read the validated value from the configuration supplied by
the server:

```python
from langchain_core.runnables import RunnableConfig

async def agent_node(state: AgentState, config: RunnableConfig):
    tenant_id = config["configurable"]["tenant_id"]
    return state
```

Create the agent after authentication for each request, as shown in the
[self-hosted authentication guide](/auth).

</Tab> <Tab value="TypeScript"> Set runtime context and execution controls where your trusted backend invokes the graph. `recursionLimit` is a top-level execution setting; your application values belong in `context`:

```typescript title="agent.ts"
const result = await graph.invoke(input, {
  context: { tenantId: verifiedTenantId },
  recursionLimit: 50,
});
```

Read the validated context through the node's LangGraph runtime. See
[LangGraph's runtime configuration guide](https://docs.langchain.com/oss/javascript/langgraph/use-graph-api#add-runtime-configuration)
for the matching context schema and node signature.

</Tab> </Tabs>

What not to do

Do not put raw credentials in model-visible context or graph state.
Do not persist credentials merely to make them available on later turns.
Do not trust a value merely because an adapter placed it in RunnableConfig.
Do not let a browser choose recursion limits, callbacks, metadata, or other server execution controls.
Do not reuse request-scoped identity between runs. Validate every request.