# Bots get in too: MCP server portals now support service tokens!

Hey there, it's Shiichan! Today I found a handy little update about how AI agents authenticate. Let me walk you through it!

## What was announced?

Over on the Cloudflare Changelog, they announced that you can now connect to an [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) using an [Access service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). Service token sessions can reach upstream MCP servers through the portal without a browser-based OAuth flow.

## The story so far

Until now, connecting to an MCP server portal assumed a human signing in through a browser-based OAuth flow. But if the caller is an agent or a bot, it can't exactly click through a login page. That made portals awkward for anything running unattended.

## What changes

With a service token, a bot connects using just two headers, `CF-Access-Client-Id` and `CF-Access-Client-Secret`, and it sees the tools from every linked server it is authorized for. No human in the loop, and machines can still authenticate cleanly!

## Dive Deep

Here is the setup flow:

- Add a [Service Auth policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#service-auth) that matches your service token to the portal's Access application.
- Add a Service Auth policy that matches the same token to each linked MCP server's Access application.
- Turn **Require user auth** off (`on_behalf: false`) for each linked server so the portal uses the admin credential instead of a per-user OAuth grant.

One caveat: servers that still require per-user OAuth are excluded from service token sessions, because a service token can't complete a per-user OAuth grant.

For the step-by-step version, check out [Connect with a service token](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token).

## Wrap-up

- MCP server portals now accept Access service tokens
- Agents and bots reach upstream MCP servers without a browser OAuth flow
- Setup is just adding Service Auth policies on the portal and each linked server, then setting `on_behalf: false`
- Servers that still require per-user OAuth are left out

This one is perfect for anyone who wants unattended AI agents to authenticate behind Cloudflare One!