feat(gateway): add per-user personal credential store#4024
Open
ecthelion77 wants to merge 3 commits intoIBM:mainfrom
Open
feat(gateway): add per-user personal credential store#4024ecthelion77 wants to merge 3 commits intoIBM:mainfrom
ecthelion77 wants to merge 3 commits intoIBM:mainfrom
Conversation
ecthelion77
requested review from
crivetimihai,
kevalmahajan and
madhav165
as code owners
jonpspri
added
the
COULD
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
22aee4a to
0fb03ad
Compare
Contributor
Author
|
Suggested labels: |
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
0fb03ad to
1e47984
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
6 times, most recently
from
fdef2a5 to
85e520b
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
2 times, most recently
from
759ed04 to
51f376c
Compare
added 2 commits
April 27, 2026 12:04
…tion Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>
Per-user personal credentials (API keys, basic auth) stored in user_gateway_credentials were only checked when the gateway did NOT have OAuth configured. For OAuth-enabled gateways (like Freshservice), the OAuth token was always used even when a per-user API key existed. Move the per-user credential lookup BEFORE the OAuth branch so that personal credentials take priority. This fixes write operations on APIs where OAuth tokens lack sufficient permissions but API keys work (e.g. Freshservice PM task updates). Affects both invoke_tool_direct and invoke_tool MCP code paths. Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
51f376c to
8c98fe0
Compare
…inity - mcp_session_pool module was removed in upstream; replaced with get_session_affinity() from session_affinity module - settings.mcp_session_pool_enabled replaced with settings.mcpgateway_session_affinity_enabled Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✨ Feature / Enhancement PR
🔗 Epic / Issue
Closes #4006
🚀 Summary (1-2 sentences)
Add a personal credential storage system enabling individual users to store their own API keys/tokens for specific gateways, with automatic per-user auth on non-OAuth tool invocations.
🧪 Checks
make lintpasses (ruff + black)make testpasses📓 Notes
Use case
Some MCP backends require per-user authentication via API keys rather than OAuth. This feature lets each user store their own credentials for a gateway, which are automatically used during tool invocations.
Authentication flow (non-OAuth gateways)
Supported credential types
api_key:Authorization: Basic base64(key:X)bearer_token:Authorization: Bearer <token>basic_auth:Authorization: Basic base64(value)Changes
db.pyuser_gateway_credentialstablecredential_storage_service.pycredential_router.pyGET/PUT/DELETEper gateway)tool_service.pymain.pyadmin.js,gateways.js,admin.html,gateways_partial.html)Security
EncryptionService(gateway_id, user_email)prevents duplicates