Runtype
Changelog
FeatureJuly 10, 20261 min read

Multi-header authentication for MCP servers

Connect MCP servers that require an API key plus tenant, project, base-URL, or routing headers, with encrypted secret references for credentials.

mcpauthenticationsecretsintegrations

Custom MCP servers can now authenticate with multiple headers on every discovery and tool request.

Choose Advanced authentication → Multiple headers when a server needs more than one value, such as an API key plus a tenant ID or project-specific base URL. Each row supports a literal value or an encrypted {{secret:NAME}} reference.

  • Header names and values are validated before a request is sent, including case-insensitive duplicate detection.
  • Secret references resolve in the caller's account and end-user scope and are registered with the leak guard.
  • Pasted Claude and Cursor MCP configs with multiple headers are recognized by the dashboard.
  • Saved servers, inline agent MCPs, API and SDK contracts, portable runtime execution, and runtime exports all preserve the same authentication shape.

Existing bearer, API-key, basic, and single custom-header configurations continue to work unchanged.