Authentication

Credential Pattern

Every MCP server definition carries a credentialId integer. At call time, IMCPClientFactory calls ICredentialResolver.GetPasswordAsync(credentialId) to retrieve the secret and injects it into the transport before the tool call is made. Workflow designers configure a credentialId — never a token or password.

Supported Authentication Modes

IMCPClientFactory — Credential Injection

public class MCPClientFactory : IMCPClientFactory
{
    private readonly ICredentialResolver _credentials;

    public MCPClientFactory(ICredentialResolver credentials)
    {
        _credentials = credentials;
    }

    public async Task<IMCPClient> CreateClientAsync(
        IMCPServerDefinition server,
        CancellationToken ct)
    {
        if (server.TransportType == MCPTransportType.StdIo)
            return new StdIoMCPClient(server);

        // Resolve secret — never stored in server definition
        string secret = await _credentials.GetPasswordAsync(server.CredentialId, ct);

        var authMode = DetectAuthMode(secret);
        return authMode switch
        {
            AuthMode.OAuthClientCredentials => await BuildOAuthClientAsync(server, secret, ct),
            AuthMode.mTLS                   => BuildMtlsClient(server, secret),
            _                               => new HttpMCPClient(server, bearerToken: secret)
        };
    }

    private static AuthMode DetectAuthMode(string secret)
    {
        if (!secret.TrimStart().StartsWith("{")) return AuthMode.ApiKey;
        using var doc = JsonDocument.Parse(secret);
        if (doc.RootElement.TryGetProperty("clientSecret", out _)) return AuthMode.OAuthClientCredentials;
        if (doc.RootElement.TryGetProperty("cert", out _)) return AuthMode.mTLS;
        return AuthMode.ApiKey;
    }
}

Registering Credentials

// API Key:
POST /api/credentials
{
  "name": "bfai-document-ai-key",
  "type": "ApiKey",
  "value": "sk-bfai-doc-xxxxxxxxxxxxxxxx"
}
// → returns credentialId: 201

// OAuth 2.0:
POST /api/credentials
{
  "name": "bfai-risk-ai-oauth",
  "type": "ApiKey",
  "value": "{\"clientId\":\"risk-client\",\"clientSecret\":\"...\",\"tokenUrl\":\"https://auth.bfai.internal/token\"}"
}
// → returns credentialId: 202

Credential Rotation

To rotate a credential, update the secret value via PUT /api/credentials/{id}. No workflow changes are needed — all server definitions reference the credential by ID. The next tool call after rotation automatically uses the new secret.