Cloudflare One, Access - Service token support for MCP server portals

<p>You can now connect autonomous agents and bots to an <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/">MCP server portal</a> using an <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/">Access service token</a>. Service token sessions can reach upstream MCP servers through the portal without a browser-based OAuth flow.</p> <p>To set this up:</p> <ul> <li>Add a <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#service-auth">Service Auth policy</a> that matches your service token to the portal's Access application.</li> <li>Add a Service Auth policy that matches the same token to each linked MCP server's Access application.</li> <li>Turn <strong>Require user auth</strong> off (<code>on_behalf: false</code>) for each linked server so the portal uses the admin credential instead of a per-user OAuth grant.</li> </ul> <p>The bot connects with <code>CF-Access-Client-Id</code> and <code>CF-Access-Client-Secret</code> headers and sees the tools from every linked server it is authorized for. Servers that still require per-user OAuth are excluded from service token sessions because a service token cannot complete a per-user OAuth grant.</p> <p>For step-by-step setup, refer to <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token">Connect with a service token</a>.</p>