diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index b5848b3..0714348 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -13,10 +13,10 @@ data:
     # JWT Authentication for /v1/* endpoints (LLM API)
     auth:
       enabled: true
-      issuer: "https://authentik.riotpiao.com/application/o/portfolio-agent/"
-      audience: "portfolio-agent"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/portfolio-agent/jwks/"
-      requiredCapability: ""
+      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
+      audience: "api-gw"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+      requiredCapability: "llm:inference"
     
     # Routes: standard HTTP proxy routes (not LLM-specific)
     # These are for non-LLM services (agent-pod/console, etc.)