MCP Authentication

MCP Authentication

Secure your MCP server so only authorized agents and users can access your tools and resources.

API Key Auth

The simplest approach is an API key passed in the Authorization header. Configure the expected key in your server and the matching key in your agent config.

OAuth 2.0

For multi-tenant setups, use OAuth 2.0 with a client credentials flow. The platform will automatically obtain and refresh tokens before each request.

mTLS

For maximum security in internal networks, configure mutual TLS. Both the agent and server present certificates, ensuring only trusted parties can communicate.

Why authentication matters

An MCP server exposes real capabilities to AI agents. Without authentication, any agent — or anyone who can reach your server’s URL — can invoke those capabilities. Secure your server appropriately for the sensitivity of the tools it exposes.

API key authentication

The simplest approach. Your server validates an API key in the Authorization header of every request. Queue sends the key automatically when configured in queue.yaml:

mcp: servers: - name: my-server url: https://mcp.my-service.com auth: type: api_key key: ${MY_SERVER_API_KEY}

Bearer token (OAuth 2.0 client credentials)

For multi-tenant setups, use OAuth 2.0 with the client credentials flow. Queue will automatically obtain a token from your authorization server and refresh it before expiry:

auth: type: oauth2 token_url: https://auth.my-service.com/token client_id: ${OAUTH_CLIENT_ID} client_secret: ${OAUTH_CLIENT_SECRET} scope: mcp:read mcp:execute

mTLS

For internal services where both sides must prove their identity, configure mutual TLS. Queue presents a client certificate on every request, and your server validates it against a trusted CA.

auth: type: mtls client_cert: ${MCP_CLIENT_CERT_PATH} client_key: ${MCP_CLIENT_KEY_PATH}

Validating credentials on the server

In your MCP server, validate credentials in a middleware before every request. Reject unauthorized requests with HTTP 401 before the MCP protocol handler runs. Never rely on obscurity — assume your server URL will be discovered.

Per-user credentials

For servers that act on behalf of individual users (accessing their GitHub, Notion, or similar), use the OAuth 2.0 authorization code flow. Queue supports this via the workspace’s per-user credential store — users authenticate once, and Queue injects their token into agent runs automatically.