> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Token Passthrough

> The gateway forwards the agent's own token to an MCP server unchanged.

Some MCP servers authenticate the end user themselves. A passthrough server, with an `auth` of `{"type": "passthrough"}`, receives the agent's `Authorization` header unchanged. The gateway does not inspect the token, and the server decides whether to accept it. When the server refuses the token, the agent gets an error result, `Error: upstream authentication required (HTTP 401)`, and `tools/list` leaves out the server's tools.

The agent names the passthrough servers in the `x-mcp-servers` header. The gateway does not authenticate a request whose servers are all passthrough servers, and leaves it out of spend and rate limits.

## Per-Request Headers

A request can carry a header for one server in `x-mcp-{server}-{header}`. The gateway sends it to that server as `{header}`, with the value as given. With a key, the agent authenticates to the gateway in `Authorization` and sends the server's token alongside:

```text theme={null}
Authorization: Bearer <key>
x-mcp-github-authorization: Bearer <GitHub token>
```

The server `github` receives `Authorization: Bearer <GitHub token>`. A server can also take named headers from the agent's request as they are, in its `forwarded_headers`.