Bearer Auth

JWT Bearer authenticates the inbound AI agent connection, at the gateway itself, before any tool call reaches an upstream MCP server or HTTP API. It uses the open-source jwt guard.

How It's Wired

JWT Bearer authenticates the session directly on the mcp server binding, through its own options.authorization field, not on a fronting http server route. The jwt guard's extracted credentials are matched against the inbound Authorization header using a template (Bearer {credentials} by default); a request whose header doesn't match, or whose credentials the guard rejects, is turned away with a 401 response and a WWW-Authenticate challenge before it ever reaches the MCP proxy or an upstream tool provider. See JWT Bearer for a worked example.

A second, more granular layer sits on top of session authentication: routes[].guarded on the mcp proxy and mcp client bindings authorizes individual tools, prompts, and resources by role, once the session itself is already authenticated. See Centralized Auth for how these layers combine.