feat(gateway): add per-user personal credential store#4024
Open
ecthelion77 wants to merge 2 commits into
Open
Conversation
ecthelion77
requested review from
crivetimihai,
kevalmahajan and
madhav165
as code owners
jonpspri
added
the
COULD
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
22aee4a to
0fb03ad
Compare
Contributor
Author
|
Suggested labels: |
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
0fb03ad to
1e47984
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
6 times, most recently
from
fdef2a5 to
85e520b
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
3 times, most recently
from
51f376c to
8c98fe0
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
8c42323 to
1532e9d
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
1532e9d to
7858974
Compare
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
221b096 to
e632591
Compare
added 2 commits
June 29, 2026 11:51
…tion Includes CSP-compatible Store Credential admin UI menu item. Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>
…guard - Rename stale build_gateway_auth_headers patches to async resolve_gateway_auth_headers across transport/resource/tool/identity propagation unit tests (callers now use the async resolver). - Remove duplicate build_ patch lines left next to resolve_ patches. - Restore validate_meta_data import + guard in read_resource direct-proxy branch, forward meta as model_dump() dict, log only meta keys (CWE-532). Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>
ecthelion77
force-pushed
the
feat/personal-credential-store-upstream
branch
from
0831c7e to
fbab360
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✨ Feature / Enhancement PR
🔗 Epic / Issue
Closes #4006
🚀 Summary (1-2 sentences)
Add a personal credential storage system enabling individual users to store their own API keys/tokens for specific gateways, with automatic per-user auth on non-OAuth tool invocations.
🧪 Checks
make lintpasses (ruff + black)make testpasses📓 Notes
Use case
Some MCP backends require per-user authentication via API keys rather than OAuth. This feature lets each user store their own credentials for a gateway, which are automatically used during tool invocations.
Authentication flow (non-OAuth gateways)
Supported credential types
api_key:Authorization: Basic base64(key:X)bearer_token:Authorization: Bearer <token>basic_auth:Authorization: Basic base64(value)Changes
db.pyuser_gateway_credentialstablecredential_storage_service.pycredential_router.pyGET/PUT/DELETEper gateway)tool_service.pymain.pyadmin.js,gateways.js,admin.html,gateways_partial.html)Security
EncryptionService(gateway_id, user_email)prevents duplicates