Support custom headers for connectors.

[rryan]

Problem Statement

Claude.ai MCP connectors only support OAuth. For custom MCP servers, a low-tech basic auth solution would be very nice.

Claude Code and Desktop support custom headers. This enables the use of Bearer tokens, HTTP basic auth, or an ad-hoc approach to auth.

For example:

claude mcp add --transport http myCoolMCP https://example.com/mcp --header "Authorization: Basic ZXhhbXBsZTpodW50ZXIy"

Proposed Solution

It would be great if claude.ai would support a custom header option like Claude Code and Desktop. Going full OAuth for a custom-built MCP server is often overkill when there is only a single user and a simple single password / token would be sufficient security for one's threat model.

Alternatives Considered

No response

Area

MCP Connector (adding/managing servers)

Priority

Critical - Blocking my MCP server development

Additional Context

No response

[faizanakram99]

It is even needed for using "Ask your org" efficiently as Github connector isn't available there, the only alternative is to use github mcp server with PAT (like that of a shared github account, typically used for bot accounts). (doesn't work)

[magnusburton]

We're also interested in support for custom connector headers!

[PavelLoparev]

+1

[fuvidani]

This would be a great addition! 🙏

[stevepeck]

Would really like this capability please!

[andycop]

+1 for custom headers, I would love to give claude a cloudflare service token to use against a cloudflare access token

[RadixSeven]

My use case
As a user with a personal server for which I control all the infrastructure and for which I will always be the only user, I want to pass a custom header or Authorization: Bearer header with a private key value to the MCP server as part of the HTTPS request so that the request is distinguished from unauthorized users, the results are filtered according to the permissions I assigned to Claude Web (which are different from Claude Desktop on my personal machine) and I don't need to do too much extra work (this already works for Claude Code).

Discussion
OAuth is both overkill (lots of extra complexity to maintain and debug in order to just validate that the request is coming an agent running with certain visibility permissions rather than J. Random Hacker) and solves the wrong problem (I don't want to delegate my account's authority, among many accounts on the server, I want the Claude web client to have particular permissions granted by a token).
I'm using a custom header, but another equally valid solution would be Authorization: Bearer <token> header. It would take me only a small code modification to support Authorization: Bearer <token>. These headers are an established pattern (RFC 6750) that's neither novel nor insecure — it's exactly what most APIs use for non-delegated authentication.
Right now, the two options are OAuth or no web support at all. Custom headers should be straightforward to add and an Authorization header would be even easier and would meet a real need.

[Doriiaan]

+1
It would be very nice to add the headers option in the Claude.ai GUI (web app)

Have a good day :)

[ashtli10]

+1

[Stevoman]

+1

It doesn't even have to be that configurable, if you are worried about the complexity of letting users set any headers. At a minimum, please allow us to just specify a bearer token in the Claude.ai Connector setup. Then tell all the developers how they should expect Claude.ai to pass that token into their MCP Servers.

[Doriiaan]

+1

It doesn't even have to be that configurable, if you are worried about the complexity of letting users set any headers. At a minimum, please allow us to just specify a bearer token in the Claude.ai Connector setup. Then tell all the developers how they should expect Claude.ai to pass that token into their MCP Servers.

I know this causes security issues, but it's the closest thing to it.

This is what I did on my end: I added a query parameter to the url: token=.

[darren277]

Yeah this is kinda very much needed.

+1

[wyf18]

+1 on this. I'm running a self-hosted MCP server for personal use. Right now the only options are: (a) no auth at all, or (b) set up a full OAuth flow — which is way overkill for a single-user setup.

This isn't just a convenience issue, it's a security gap. Anyone who discovers the tunnel URL can hit the MCP endpoints with zero friction. A simple Bearer token header would let us authenticate requests without the overhead of OAuth.

Claude Code already supports --header, so the pattern exists. Would love to see this in claude.ai connectors as well. It's been 2+ months since this was opened — any update on this?