Inbound credentials
The credential a caller presents to a proxy or MCP server.
An inbound credential is what a caller sends to RequestRocket. It is stored as credentialType: "proxy" and is separate from the target credential RequestRocket sends upstream.
| Auth type | Caller sends | Required secret fields |
|---|---|---|
key | A configured header or query value | key, value, addToHeader |
bearer | A static bearer token | token, addToHeader |
basic | HTTP Basic credentials | username, password |
jwt | A static JWT value | token, addToHeader |
jwtVerify | A JWT verified against a JWKS URI or shared secret | algorithms, and exactly one of jwksUri or sharedSecret |
idpVerify | A JWT verified against an identity provider | algorithms, HTTPS issuer, audience, jwksUri |
Customer-published MCP servers additionally support the built-in OAuth2 consumer pool. That is selected as consumer_pool on the server rather than created as a credential record.
Create a key
Open Inbound Credentials and open the New tab. Name it, select the region used by the proxy or MCP server, and set the auth type to Key. Enter the header name and secret value.
Result and rotation
Attach the saved credential to a proxy or direct MCP server in the same region. To rotate auth material, create a replacement credential, switch the proxy or server to it, verify a call, and then retire the old credential. Existing credential secrets and auth types cannot be changed.
Troubleshooting
jwtVerifyrequiresalgorithmsand exactly one ofjwksUriorsharedSecret.idpVerifyrequires an HTTPS issuer, an audience, and a JWKS URI.- A pending or temporary credential cannot be used until completed, and a direct MCP server refuses a temporary credential.