feat(mcp): Add HTTP header bearer token authentication support #914

devin-ai-integration · 2025-12-16T00:35:08Z

This PR targets the following PR:

feat: Add bearer token authentication support #866

Summary

Enable PyAirbyte MCP tools to authenticate via Authorization header when running over HTTP transport. This allows a single shared MCP server to handle requests from multiple users with different bearer tokens, rather than requiring a subprocess per request.

Changes:

Add get_bearer_token_from_headers() utility in airbyte/mcp/_util.py that extracts bearer tokens from HTTP Authorization headers using fastmcp's get_http_headers()
Update resolve_cloud_bearer_token() in airbyte/cloud/auth.py to check HTTP headers first before falling back to environment variables
Add noqa: SLF001 comments in airbyte/cloud/connectors.py for private member access (lint fixes)
Add noqa: PLR0904 comment on CloudWorkspace class (lint fix for too many public methods)

Token resolution order:

Explicit input_value parameter
HTTP Authorization: Bearer <token> header (when running as MCP HTTP server)
AIRBYTE_CLOUD_BEARER_TOKEN environment variable

Review & Testing Checklist for Human

Verify import side effects are acceptable: airbyte.cloud.auth now imports from airbyte.mcp._util at module load time, which triggers fastmcp imports. Verify this doesn't break code that imports auth.py but doesn't use MCP.
Review resolution order change: The original resolve_cloud_bearer_token() passed input_value as default to try_get_secret(). Now it checks input_value first explicitly and passes default=None to the env var fallback - verify this doesn't break existing callers.
Verify HTTP transport works: Start MCP HTTP server, send request with Authorization: Bearer <token> header, verify API calls use that token
Verify stdio transport still works: Confirm env var fallback works when not running over HTTP

Recommended test plan:

# Start MCP HTTP server
poetry run poe mcp-serve-http

# Test with bearer token header (in another terminal)
curl -X POST http://127.0.0.1:8000/... \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"tool": "list_workspaces", "args": {}}'

Notes

All imports are at top-level following repo standards (no inline imports)
No unit tests added - the functionality depends on fastmcp's HTTP context which is difficult to mock
Verified no circular dependencies exist between airbyte.cloud.auth and airbyte.mcp._util
Requested by [email protected]
Devin session: https://app.devin.ai/sessions/fb42374d4b6640baa6e240fb6a1c6ba9

Updates since last revision

Removed unrelated CI type fixes per user request (changes to api_util.py, cloud_ops.py, and .github/ workflow files)
PR now contains only spec-related changes and lint fixes (noqa comments)
Base PR feat: Add bearer token authentication support #866 is expected to handle any remaining CI type issues

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…ility (#912) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Enable PyAirbyte MCP tools to authenticate via Authorization header when running over HTTP transport. This allows a single shared MCP server to handle requests from multiple users with different bearer tokens. Changes: - Add get_bearer_token_from_headers() utility in airbyte/mcp/_util.py - Update resolve_cloud_bearer_token() to check HTTP headers first Resolution order for bearer token: 1. Explicit input_value parameter 2. HTTP Authorization header (when running as MCP HTTP server) 3. AIRBYTE_CLOUD_BEARER_TOKEN environment variable Co-Authored-By: [email protected] <[email protected]>

devin-ai-integration · 2025-12-16T00:35:10Z

Original prompt from [email protected]

Received message in Slack channel #ask-devin-ai:

@Devin can you stack an PR on the top of <https://github.com/airbytehq/PyAirbyte/pull/866> for the below spec?
```## PyAirbyte MCP: HTTP Header Bearer Token Authentication Spec

### Overview

Enable PyAirbyte MCP tools to authenticate via `Authorization` header when running over HTTP transport, allowing a single shared MCP server to handle requests from multiple users with different bearer tokens.

### Current Behavior

Tools read bearer token from environment variable only:

```python
# airbyte/cloud/auth.py
def resolve_cloud_bearer_token(...) -&gt; SecretString | None:
    return try_get_secret(constants.CLOUD_BEARER_TOKEN_ENV_VAR, default=input_value)

Required Changes

1. Add HTTP header extraction utility

File: airbyte/mcp/_util.py (or new file)

from fastmcp.server.dependencies import get_http_headers

def get_bearer_token_from_headers() -&gt; str | None:
    """Extract bearer token from HTTP Authorization header.
    
    Returns None if not running over HTTP transport or no header present.
    """
    try:
        headers = get_http_headers()
        auth_header = headers.get("authorization", "")
        if auth_header.startswith("Bearer "):
            return auth_header[7:]  # Strip "Bearer " prefix
        return None
    except Exception:
        # Not running over HTTP transport
        return None

2. Update `resolve_cloud_bearer_token` to check headers first

File: airbyte/cloud/auth.py

def resolve_cloud_bearer_token(
    input_value: str | SecretString | None = None,
    /,
) -&gt; SecretString | None:
    """Get the Airbyte Cloud bearer token.
    
    Resolution order:
    1. Explicit input_value parameter
    2. HTTP Authorization header (when running as MCP HTTP server)
    3. AIRBYTE_CLOUD_BEARER_TOKEN environment variable
    """
    if input_value:
        return SecretString(input_value)
    
    # Try HTTP header first (for MCP HTTP tran... (1427 chars truncated...)

devin-ai-integration · 2025-12-16T00:35:12Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

github-actions · 2025-12-16T00:35:34Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1765845063-http-header-bearer-token' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1765845063-http-header-bearer-token'

Helpful Resources

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

/fix-pr - Fixes most formatting and linting issues
/poetry-lock - Updates poetry.lock file
/test-pr - Runs tests with the updated PyAirbyte
/prerelease - Builds and publishes a prerelease version to PyPI

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

Co-Authored-By: [email protected] <[email protected]>

github-actions · 2025-12-16T00:44:51Z

PyTest Results (Fast Tests Only, No Creds)

348 tests ±0 348 ✅ ±0 5m 48s ⏱️ +10s
1 suites ±0 0 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 98d6d26. ± Comparison against base commit 4f05142.

♻️ This comment has been updated with latest results.

- Move fastmcp.server.dependencies.get_http_headers import to top-level in _util.py - Move airbyte.mcp._util.get_bearer_token_from_headers import to top-level in auth.py - Remove noqa: PLC0415 comments as inline imports are no longer used Co-Authored-By: [email protected] <[email protected]>

airbyte/mcp/_util.py

…th' into devin/1765845063-http-header-bearer-token

aldogonzalez8 · 2025-12-16T00:51:14Z

Devin CI is failing

… all API call sites Co-Authored-By: [email protected] <[email protected]>

github-actions · 2025-12-16T01:02:27Z

.github/workflows/prerelease-command.yml

+
+    - name: Compute prerelease version
+      id: version
+      run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:7:39: Double quote to prevent globbing and word splitting [shellcheck]

github-actions · 2025-12-16T01:02:27Z

.github/workflows/pypi_publish.yml

-    - uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2.14.0
+    - name: Prepare version override
+      id: version
+      run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:51: Double quote to prevent globbing and word splitting [shellcheck]

github-actions · 2025-12-16T01:02:27Z

.github/workflows/pypi_publish.yml

-    - uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2.14.0
+    - name: Prepare version override
+      id: version
+      run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:2:61: Double quote to prevent globbing and word splitting [shellcheck]

Co-Authored-By: [email protected] <[email protected]>

… favor of PR branch Co-Authored-By: [email protected] <[email protected]>

Co-Authored-By: [email protected] <[email protected]>

…lint fixes Co-Authored-By: [email protected] <[email protected]>

Co-Authored-By: [email protected] <[email protected]>

github-actions · 2025-12-16T02:12:32Z

PyTest Results (Full)

416 tests ±0 391 ✅ ±0 23m 23s ⏱️ + 1m 39s
1 suites ±0 17 💤 ±0
1 files ±0 8 ❌ ±0

For more details on these failures, see this check.

Results for commit 98d6d26. ± Comparison against base commit 4f05142.

aaronsteers · 2025-12-16T23:51:47Z

airbyte/cloud/auth.py

 """Authentication-related constants and utilities for the Airbyte Cloud."""

 from airbyte import constants
+from airbyte.mcp._util import get_bearer_token_from_headers


Devin, Can you create a follow-on issue to refactor slightly...

Ideally nothing outside the MCP module would import from the MCP module. That said, this is expedient and doesn't seem to create circular dependencies or side effects (that I can see). So I'm inclined to merge and create follow-on issue for refactoring.

Created follow-on issue: #915

The issue proposes moving get_bearer_token_from_headers() to a shared utility location (like airbyte/_util/http_auth.py) so the MCP module can import from it rather than the other way around.

aaronsteers

Approving with one post-merge update requested: https://github.com/airbytehq/PyAirbyte/pull/914/changes#r2625121278

…on support This commit consolidates authentication handling for Airbyte Cloud API: - Add CloudCredentials dataclass in airbyte/cloud/credentials.py that encapsulates auth configuration (client_id/secret or bearer_token) - Add bearer token authentication support to api_util functions - Add resolve_cloud_credentials() in MCP _util.py for multi-source credential resolution (explicit params -> HTTP headers -> env vars) - Add HTTP header extraction helpers for MCP HTTP/SSE transport - Update CloudWorkspace to support bearer token authentication - Export CloudCredentials from airbyte.cloud module This replaces PRs #866, #867, and #914 with a unified implementation. Co-Authored-By: AJ Steers <[email protected]>

aaronsteers · 2025-12-17T02:53:30Z

Replaced by #916

aaronsteers and others added 6 commits December 11, 2025 22:22

feat(cloud): Add CloudWorkspace.from_env() classmethod (#909)

f882e93

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

feat: Add /prerelease slash command for PyPI prereleases (#910)

60a087f

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix: Add required permissions for prerelease workflow (#911)

3869ac4

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix: Use workflow_dispatch instead of workflow_call for OIDC compatib…

cd1b390

…ility (#912) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix: Use GitHub App token for prerelease workflow dispatch (#913)

9f3c707

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix(lint): Remove unused noqa directive in CloudWorkspace

954dd1a

Co-Authored-By: [email protected] <[email protected]>

aldogonzalez8 reviewed Dec 16, 2025

View reviewed changes

airbyte/mcp/_util.py Show resolved Hide resolved

Merge remote-tracking branch 'origin/devin/1763010134-bearer-token-au…

5298ade

…th' into devin/1765845063-http-header-bearer-token

aldogonzalez8 self-assigned this Dec 16, 2025

aldogonzalez8 requested a review from aaronsteers December 16, 2025 00:50

aldogonzalez8 marked this pull request as ready for review December 16, 2025 00:50

devin-ai-integration bot and others added 2 commits December 16, 2025 00:57

fix(types): Fix type errors from base PR merge - pass bearer_token to…

59ad29a

… all API call sites Co-Authored-By: [email protected] <[email protected]>

Merge main to get noqa comments for SLF001 lint errors

3b08a87

github-actions bot reviewed Dec 16, 2025

View reviewed changes

devin-ai-integration bot and others added 3 commits December 16, 2025 01:07

fix(lint): Add noqa comment for PLR0904 on CloudWorkspace class

4c0e44c

Co-Authored-By: [email protected] <[email protected]>

fix(lint): Update noqa comments to force merge conflict resolution in…

dcde4aa

… favor of PR branch Co-Authored-By: [email protected] <[email protected]>

Merge base PR branch and resolve conflicts in favor of noqa comments

96ed8d4

Co-Authored-By: [email protected] <[email protected]>

aldogonzalez8 changed the title ~~feat(mcp): Add HTTP header bearer token authentication support (do not merge)~~ feat(mcp): Add HTTP header bearer token authentication support Dec 16, 2025

devin-ai-integration bot and others added 2 commits December 16, 2025 01:38

refactor: Remove unrelated CI type fixes, keep only spec changes and …

d0215fd

…lint fixes Co-Authored-By: [email protected] <[email protected]>

chore: Remove internal task tracking file

98d6d26

Co-Authored-By: [email protected] <[email protected]>

coderabbitai bot approved these changes Dec 16, 2025

View reviewed changes

aaronsteers reviewed Dec 16, 2025

View reviewed changes

devin-ai-integration bot mentioned this pull request Dec 16, 2025

refactor: Move get_bearer_token_from_headers() out of MCP module #915

Closed

aaronsteers approved these changes Dec 16, 2025

View reviewed changes

aaronsteers mentioned this pull request Dec 17, 2025

feat(cloud): Add CloudCredentials class and bearer token authentication support #916

Merged

5 tasks

aaronsteers closed this Dec 17, 2025

feat(mcp): Add HTTP header bearer token authentication support #914

feat(mcp): Add HTTP header bearer token authentication support #914

Uh oh!

Conversation

devin-ai-integration bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review & Testing Checklist for Human

Notes

Updates since last revision

Uh oh!

devin-ai-integration bot commented Dec 16, 2025

Required Changes

1. Add HTTP header extraction utility

2. Update resolve_cloud_bearer_token to check headers first

Uh oh!

devin-ai-integration bot commented Dec 16, 2025

🤖 Devin AI Engineer

Uh oh!

github-actions bot commented Dec 16, 2025

👋 Greetings, Airbyte Team Member!

Testing This PyAirbyte Version

Helpful Resources

PR Slash Commands

Community Support

Uh oh!

github-actions bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PyTest Results (Fast Tests Only, No Creds)

Uh oh!

Uh oh!

aldogonzalez8 commented Dec 16, 2025

Uh oh!

github-actions bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 16, 2025

PyTest Results (Full)

Uh oh!

aaronsteers Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

aaronsteers left a comment

Choose a reason for hiding this comment

Uh oh!

aaronsteers commented Dec 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

devin-ai-integration bot commented Dec 16, 2025 •

edited

Loading

2. Update `resolve_cloud_bearer_token` to check headers first

github-actions bot commented Dec 16, 2025 •

edited

Loading