Auth Overrides

Replace a server’s default credentials with user-specific tokens for MCP servers in TrueFoundry AI Gateway

Auth Overrides let you replace an MCP server’s default credentials with user-specific tokens. As a manager, you can create, view, and delete overrides for any user on the server. When an override is set for a user or virtual account, the Gateway uses their override token instead of the server’s default credentials for all requests made by that entity.

When to use Auth Overrides

Auth Overrides are useful when:

• The upstream MCP server requires user-specific API keys (e.g., each developer has their own key for a third-party service)
• You need to attribute API usage to individual users at the downstream service
• The upstream service enforces per-user rate limits or permissions

Auth Overrides work with API Key authentication configured with Individual Credentials. When Individual Credentials is selected, the header value uses a placeholder like Bearer {{API_KEY}}, and each user must supply their own key before they can use the MCP server.

For details on configuring API Key authentication with Shared or Individual Credentials, see the Getting Started guide.

Managing Auth Overrides

Navigate to the MCP server detail page and click on the Auth Overrides tab to view all existing overrides.

The Auth Overrides table shows the following columns:

Column	Description
Entity	The user or virtual account the override applies to
Type	Whether the entity is a user or virtual account
Auth	The authentication type being overridden
Updated by	Who last modified this override
Credentials	The masked credential value

Adding an Auth Override

1. Open the Auth Overrides tab

   Navigate to the MCP server detail page and click the Auth Overrides tab.

2. Click Add Override

   Click the + Add Override button in the top right corner.

3. Configure the override

   • Subject: Select the user or virtual account that will use this override

   • API KEY: Enter the API key that this user should use when calling the upstream MCP server

     
4. Submit

   Click Submit to save the override. The Gateway will now use this key for all requests made by the selected user.

Editing or Deleting an Override

To update an existing override, click the edit icon next to the override in the Auth Overrides table. To delete an override, click the delete icon — the user will revert to the server’s default credentials (if any).

How Auth Overrides work at runtime

When a user makes a request through the Gateway to an MCP server with Auth Overrides configured:

1. The Gateway authenticates the user (inbound authentication)
2. The Gateway checks if an Auth Override exists for this user on this MCP server
3. If an override exists: The Gateway injects the user’s override credentials into the request
4. If no override exists: The Gateway uses the server’s default credentials (for Shared Credentials) or returns an error (for Individual Credentials)

For MCP servers configured with Individual Credentials, users without an Auth Override will not be able to use the server until an override is created for them.