Skip to main content
Version: Next

Guided Setup For Token-Authenticated Remote Servers

Some remote MCP servers require a user-supplied bearer token for authorization instead of OAuth. Previously, the initial integration attempt to these servers failed automatically with no explanation. Users now get a clear signal during setup prompting them to add their own API key or token, streamlining the connection to third-party MCP servers that need it.

Applies to any server authenticating over the standard Authorization: Bearer <access-token> header, per the MCP authorization spec.

Admin configuration​

To mark a header as requiring user-supplied input, admins wrap the header's value in double curly brackets, for example Authorization: Bearer {{API_KEY}}. This flags the field as user-specific, and users are prompted to enter their own personal API key for that header before the integration can complete.

Let's use Cloudflare MCP Server as an example:

{
  "mcpServers": {
    "cloudflare-api": {
      "url": "https://mcp.cloudflare.com/mcp",
      "headers": {
        "Authorization": "Bearer {{YOUR_CLOUDFLARE_API_TOKEN}}"
      }
    }
  }
}

Reference configs​

Reference configs are now documented for common providers:

  • github - GitHub's hosted MCP server (https://api.githubcopilot.com/mcp/), authenticated with a personal access token.
  • cloudflare-api - Cloudflare's MCP server (https://mcp.cloudflare.com/mcp), authenticated with an API token, primarily for automation and CI/CD use cases.
  • Custom or internal MCP servers using the same Authorization: Bearer pattern.