​
Overview

Header-based authentication allows you to secure your MCP Server by requiring a specific API key or token in the request headers. This method is ideal for APIs that use static credentials for access control.

Below, we demonstrate how to configure header authentication using the Hugging Face Hub API as an example.

​
Quick Start: Hugging Face Hub Example

  1. In the AI Gateway UI, navigate to the MCP Servers tab and click Add New MCP Server Group.

  2. Click Add MCP Server and provide the following details:

    • Name: hf-mcp-server
    • Endpoint URL: https://hf.co/mcp
    • Description: Demo MCP server for Hugging Face Hub API. Requires a Hugging Face token in the header for access.
    • Auth Data:
      • Header Name: Authorization
      • Header Value: Bearer <YOUR_HF_TOKEN> (replace with your actual token)

    Hugging Face MCP Server Header Auth Example

​
When to Use Header Authentication

  • When an API requires a static API key, token, or custom header for access
  • For simple, per-request authentication needs
  • For internal services or partner APIs that use shared secrets
  • When you want to enable access for all users of the MCP using shared credentials—such as a common API key, service account, or virtual account—so everyone with MCP access can use the integration. In these cases, ensure shared credentials are managed securely and rotated regularly.

​
Security Best Practices

Security Warning

  • Never share authentication keys publicly or in unsecured channels.
  • Rotate shared credentials regularly.
  • For production or sensitive use cases, prefer OAuth2 or other robust authentication methods if available.