feat(mcp): Add HTTP header bearer token authentication support by devin-ai-integration[bot] · Pull Request #914 · airbytehq/PyAirbyte

devin-ai-integration · 2025-12-16T00:35:08Z

This PR targets the following PR:

feat: Add bearer token authentication support #866

Summary

Enable PyAirbyte MCP tools to authenticate via Authorization header when running over HTTP transport. This allows a single shared MCP server to handle requests from multiple users with different bearer tokens, rather than requiring a subprocess per request.

Changes:

Add get_bearer_token_from_headers() utility in airbyte/mcp/_util.py that extracts bearer tokens from HTTP Authorization headers using fastmcp's get_http_headers()
Update resolve_cloud_bearer_token() in airbyte/cloud/auth.py to check HTTP headers first before falling back to environment variables
Add noqa: SLF001 comments in airbyte/cloud/connectors.py for private member access (lint fixes)
Add noqa: PLR0904 comment on CloudWorkspace class (lint fix for too many public methods)

Token resolution order:

Explicit input_value parameter
HTTP Authorization: Bearer <token> header (when running as MCP HTTP server)
AIRBYTE_CLOUD_BEARER_TOKEN environment variable

Review & Testing Checklist for Human

Verify import side effects are acceptable: airbyte.cloud.auth now imports from airbyte.mcp._util at module load time, which triggers fastmcp imports. Verify this doesn't break code that imports auth.py but doesn't use MCP.
Review resolution order change: The original resolve_cloud_bearer_token() passed input_value as default to try_get_secret(). Now it checks input_value first explicitly and passes default=None to the env var fallback - verify this doesn't break existing callers.
Verify HTTP transport works: Start MCP HTTP server, send request with Authorization: Bearer <token> header, verify API calls use that token
Verify stdio transport still works: Confirm env var fallback works when not running over HTTP

Recommended test plan:

# Start MCP HTTP server
poetry run poe mcp-serve-http

# Test with bearer token header (in another terminal)
curl -X POST http://127.0.0.1:8000/... \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"tool": "list_workspaces", "args": {}}'

Notes

All imports are at top-level following repo standards (no inline imports)
No unit tests added - the functionality depends on fastmcp's HTTP context which is difficult to mock
Verified no circular dependencies exist between airbyte.cloud.auth and airbyte.mcp._util
Requested by aldo.gonzalez@airbyte.io
Devin session: https://app.devin.ai/sessions/fb42374d4b6640baa6e240fb6a1c6ba9

Updates since last revision

Removed unrelated CI type fixes per user request (changes to api_util.py, cloud_ops.py, and .github/ workflow files)
PR now contains only spec-related changes and lint fixes (noqa comments)
Base PR feat: Add bearer token authentication support #866 is expected to handle any remaining CI type issues

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…ility (#912) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Enable PyAirbyte MCP tools to authenticate via Authorization header when running over HTTP transport. This allows a single shared MCP server to handle requests from multiple users with different bearer tokens. Changes: - Add get_bearer_token_from_headers() utility in airbyte/mcp/_util.py - Update resolve_cloud_bearer_token() to check HTTP headers first Resolution order for bearer token: 1. Explicit input_value parameter 2. HTTP Authorization header (when running as MCP HTTP server) 3. AIRBYTE_CLOUD_BEARER_TOKEN environment variable Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

devin-ai-integration · 2025-12-16T00:35:10Z

Original prompt from aldo.gonzalez@airbyte.io

Received message in Slack channel #ask-devin-ai:

@Devin can you stack an PR on the top of <https://github.com/airbytehq/PyAirbyte/pull/866> for the below spec?
```## PyAirbyte MCP: HTTP Header Bearer Token Authentication Spec

### Overview

Enable PyAirbyte MCP tools to authenticate via `Authorization` header when running over HTTP transport, allowing a single shared MCP server to handle requests from multiple users with different bearer tokens.

### Current Behavior

Tools read bearer token from environment variable only:

```python
# airbyte/cloud/auth.py
def resolve_cloud_bearer_token(...) -&gt; SecretString | None:
    return try_get_secret(constants.CLOUD_BEARER_TOKEN_ENV_VAR, default=input_value)

Required Changes

1. Add HTTP header extraction utility

File: airbyte/mcp/_util.py (or new file)

from fastmcp.server.dependencies import get_http_headers

def get_bearer_token_from_headers() -&gt; str | None:
    """Extract bearer token from HTTP Authorization header.
    
    Returns None if not running over HTTP transport or no header present.
    """
    try:
        headers = get_http_headers()
        auth_header = headers.get("authorization", "")
        if auth_header.startswith("Bearer "):
            return auth_header[7:]  # Strip "Bearer " prefix
        return None
    except Exception:
        # Not running over HTTP transport
        return None

2. Update `resolve_cloud_bearer_token` to check headers first

File: airbyte/cloud/auth.py

def resolve_cloud_bearer_token(
    input_value: str | SecretString | None = None,
    /,
) -&gt; SecretString | None:
    """Get the Airbyte Cloud bearer token.
    
    Resolution order:
    1. Explicit input_value parameter
    2. HTTP Authorization header (when running as MCP HTTP server)
    3. AIRBYTE_CLOUD_BEARER_TOKEN environment variable
    """
    if input_value:
        return SecretString(input_value)
    
    # Try HTTP header first (for MCP HTTP tran... (1427 chars truncated...)

devin-ai-integration · 2025-12-16T00:35:12Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

github-actions · 2025-12-16T00:35:34Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1765845063-http-header-bearer-token' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1765845063-http-header-bearer-token'

Helpful Resources

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

/fix-pr - Fixes most formatting and linting issues
/poetry-lock - Updates poetry.lock file
/test-pr - Runs tests with the updated PyAirbyte
/prerelease - Builds and publishes a prerelease version to PyPI

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

github-actions · 2025-12-16T00:44:51Z

PyTest Results (Fast Tests Only, No Creds)

348 tests ±0 348 ✅ ±0 5m 48s ⏱️ +10s
1 suites ±0 0 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 98d6d26. ± Comparison against base commit 4f05142.

♻️ This comment has been updated with latest results.

- Move fastmcp.server.dependencies.get_http_headers import to top-level in _util.py - Move airbyte.mcp._util.get_bearer_token_from_headers import to top-level in auth.py - Remove noqa: PLC0415 comments as inline imports are no longer used Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

…th' into devin/1765845063-http-header-bearer-token

Aldo Gonzalez (aldogonzalez8) · 2025-12-16T00:51:14Z

Devin CI is failing

… all API call sites Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

github-actions · 2025-12-16T01:02:27Z

+
+    - name: Compute prerelease version
+      id: version
+      run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:7:39: Double quote to prevent globbing and word splitting [shellcheck]

github-actions · 2025-12-16T01:02:27Z

-    - uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2.14.0
+    - name: Prepare version override
+      id: version
+      run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:51: Double quote to prevent globbing and word splitting [shellcheck]

github-actions · 2025-12-16T01:02:27Z

-    - uses: hynek/build-and-inspect-python-package@efb823f52190ad02594531168b7a2d5790e66516 # v2.14.0
+    - name: Prepare version override
+      id: version
+      run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:2:61: Double quote to prevent globbing and word splitting [shellcheck]

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

… favor of PR branch Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

…lint fixes Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

github-actions · 2025-12-16T02:12:32Z

PyTest Results (Full)

416 tests ±0 391 ✅ ±0 23m 23s ⏱️ + 1m 39s
1 suites ±0 17 💤 ±0
1 files ±0 8 ❌ ±0

For more details on these failures, see this check.

Results for commit 98d6d26. ± Comparison against base commit 4f05142.

Aaron ("AJ") Steers (aaronsteers) · 2025-12-16T23:51:47Z

 """Authentication-related constants and utilities for the Airbyte Cloud."""

 from airbyte import constants
+from airbyte.mcp._util import get_bearer_token_from_headers


Devin, Can you create a follow-on issue to refactor slightly...

Ideally nothing outside the MCP module would import from the MCP module. That said, this is expedient and doesn't seem to create circular dependencies or side effects (that I can see). So I'm inclined to merge and create follow-on issue for refactoring.

Created follow-on issue: #915

The issue proposes moving get_bearer_token_from_headers() to a shared utility location (like airbyte/_util/http_auth.py) so the MCP module can import from it rather than the other way around.

Aaron ("AJ") Steers (aaronsteers)

Approving with one post-merge update requested: https://github.com/airbytehq/PyAirbyte/pull/914/changes#r2625121278

…on support This commit consolidates authentication handling for Airbyte Cloud API: - Add CloudCredentials dataclass in airbyte/cloud/credentials.py that encapsulates auth configuration (client_id/secret or bearer_token) - Add bearer token authentication support to api_util functions - Add resolve_cloud_credentials() in MCP _util.py for multi-source credential resolution (explicit params -> HTTP headers -> env vars) - Add HTTP header extraction helpers for MCP HTTP/SSE transport - Update CloudWorkspace to support bearer token authentication - Export CloudCredentials from airbyte.cloud module This replaces PRs #866, #867, and #914 with a unified implementation. Co-Authored-By: AJ Steers <aj@airbyte.io>

Aaron ("AJ") Steers (aaronsteers) · 2025-12-17T02:53:30Z

Replaced by #916

Aaron ("AJ") Steers (aaronsteers) and others added 6 commits December 11, 2025 22:22

feat(cloud): Add CloudWorkspace.from_env() classmethod (#909)

f882e93

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

feat: Add /prerelease slash command for PyPI prereleases (#910)

60a087f

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix: Add required permissions for prerelease workflow (#911)

3869ac4

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix: Use workflow_dispatch instead of workflow_call for OIDC compatib…

cd1b390

…ility (#912) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix: Use GitHub App token for prerelease workflow dispatch (#913)

9f3c707

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix(lint): Remove unused noqa directive in CloudWorkspace

954dd1a

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Aldo Gonzalez (aldogonzalez8) reviewed Dec 16, 2025

View reviewed changes

Comment thread airbyte/mcp/_util.py

Merge remote-tracking branch 'origin/devin/1763010134-bearer-token-au…

5298ade

…th' into devin/1765845063-http-header-bearer-token

Aldo Gonzalez (aldogonzalez8) self-assigned this Dec 16, 2025

Aldo Gonzalez (aldogonzalez8) requested a review from Aaron ("AJ") Steers (aaronsteers) December 16, 2025 00:50

Aldo Gonzalez (aldogonzalez8) marked this pull request as ready for review December 16, 2025 00:50

devin-ai-integration Bot and others added 2 commits December 16, 2025 00:57

fix(types): Fix type errors from base PR merge - pass bearer_token to…

59ad29a

… all API call sites Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Merge main to get noqa comments for SLF001 lint errors

3b08a87

github-actions Bot reviewed Dec 16, 2025

View reviewed changes

devin-ai-integration Bot and others added 3 commits December 16, 2025 01:07

fix(lint): Add noqa comment for PLR0904 on CloudWorkspace class

4c0e44c

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

fix(lint): Update noqa comments to force merge conflict resolution in…

dcde4aa

… favor of PR branch Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Merge base PR branch and resolve conflicts in favor of noqa comments

96ed8d4

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Aldo Gonzalez (aldogonzalez8) changed the title ~~feat(mcp): Add HTTP header bearer token authentication support (do not merge)~~ feat(mcp): Add HTTP header bearer token authentication support Dec 16, 2025

devin-ai-integration Bot and others added 2 commits December 16, 2025 01:38

refactor: Remove unrelated CI type fixes, keep only spec changes and …

d0215fd

…lint fixes Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

chore: Remove internal task tracking file

98d6d26

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

coderabbitai Bot approved these changes Dec 16, 2025

View reviewed changes

Aaron ("AJ") Steers (aaronsteers) reviewed Dec 16, 2025

View reviewed changes

devin-ai-integration Bot mentioned this pull request Dec 16, 2025

refactor: Move get_bearer_token_from_headers() out of MCP module #915

Closed

Aaron ("AJ") Steers (aaronsteers) approved these changes Dec 16, 2025

View reviewed changes

Aaron ("AJ") Steers (aaronsteers) mentioned this pull request Dec 17, 2025

feat(cloud): Add CloudCredentials class and bearer token authentication support #916

Merged

5 tasks

Aaron ("AJ") Steers (aaronsteers) closed this Dec 17, 2025

Uh oh!

Conversation

devin-ai-integration Bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review & Testing Checklist for Human

Notes

Updates since last revision

Uh oh!

devin-ai-integration Bot commented Dec 16, 2025

Required Changes

1. Add HTTP header extraction utility

2. Update resolve_cloud_bearer_token to check headers first

Uh oh!

devin-ai-integration Bot commented Dec 16, 2025

🤖 Devin AI Engineer

Uh oh!

github-actions Bot commented Dec 16, 2025

👋 Greetings, Airbyte Team Member!

Testing This PyAirbyte Version

Helpful Resources

PR Slash Commands

Community Support

Uh oh!

github-actions Bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PyTest Results (Fast Tests Only, No Creds)

Uh oh!

Uh oh!

Aldo Gonzalez (aldogonzalez8) commented Dec 16, 2025

Uh oh!

github-actions Bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Dec 16, 2025

PyTest Results (Full)

Uh oh!

Aaron ("AJ") Steers (aaronsteers) Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Aaron ("AJ") Steers (aaronsteers) left a comment

Choose a reason for hiding this comment

Uh oh!

Aaron ("AJ") Steers (aaronsteers) commented Dec 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

devin-ai-integration Bot commented Dec 16, 2025 •

edited

Loading

2. Update `resolve_cloud_bearer_token` to check headers first

github-actions Bot commented Dec 16, 2025 •

edited

Loading