Connecting to an MCP server that offers more than one way to sign in upstream used to mean guessing which one applied. In organizations that enforce typed upstream authentication, every way of connecting now asks: the consent screen, an agent key at issue time, an assistant per trigger, and an app or workload signing in without a browser. Administrators can create credentials once and offer them on as many servers as they need, and a long list of enforcement fixes closes the gaps between how each surface checks and records the choice. More on this in Upstream credentials.

Features

• Pick an upstream credential from the consent screen — When a server offers several upstream credentials you may use, connecting now shows a choice instead of picking for you: an identity-provider sign-in, a shared credential by name, your own account, or your app's own credential, preselecting whichever you approved there last. A credential you may not use reads "No access" instead of offering a connection that cannot work. (#8038, @danielkov)
• Assistants use your own connection when they act for you — When an assistant acts for a person instead of for nobody, a server that uses that person's own account now signs in with their connection, not the assistant owner's. If you have not connected yet, the assistant sends you a private link that works only for you, while signed in, for 15 minutes. (#8044, @danielkov)
• Choose an assistant's upstream credential per server and trigger — Open an assistant's Identity settings to set which credential it uses on each MCP server it reaches, separately for turns that act for a person and turns that act for nobody. Turns already running keep the credential they started with, and every change is recorded in the audit log. (#8043, @danielkov)
• Choose the shared credential an agent key uses, per server — Creating an agent key for a server with several shared credentials now asks which one it should use there, and the key can't be issued until you choose. A rotated key keeps its choices, and service accounts now serve an agent the same way they serve a person. (#8040, @danielkov)
• Choose credentials for apps and workloads that sign in without a browser — A token request can now name the credential for each server it reaches. Without one, the session uses the credential an admin chose for that app, or the single credential the caller can use; with several candidates and no choice, the request fails clearly instead of guessing. (#8042, @danielkov)
• Create and share upstream credentials across servers — Administrators can create a personal connection, a service account, a static credential with stored headers, or a pass-through of a caller's header, then offer an existing credential on another server instead of recreating it. Rotating a credential's headers no longer requires re-entering secret values that are not changing, and every change is audited. (#8036, @danielkov)
• MCP server settings show one upstream identity surface — Organizations enforcing typed upstream authentication see the credential list under Identity; other organizations keep the legacy Identity panel, so server settings show only what applies to you. (#8371, @danielkov)

Bug fixes

• Gateway members added after you signed in work without reconnecting — A server added to a gateway after you connected now works right away when nothing is left to choose, such as no auth needed or one ready credential, instead of asking you to reconnect and pick. (#8039, @danielkov)
• Admin and Member roles include permission to use MCP auth clients — The built-in roles now grant use of MCP auth clients alongside permission to connect, and API key policies can grant use of every auth client instead of naming each one. (#8283, @danielkov)
• Upstream credential changes publish atomically — A configuration change can no longer leave a server half-updated and unusable until a later repair; credential-header and Enterprise Managed Authorization choices stay in step with normal configuration changes. (#8275, @danielkov)
• Agent gateway requests stay bound to your chosen credential — A missing, revoked, or replaced credential attachment is now refused instead of falling back to an anonymous upstream request. (#8276, @danielkov)
• Agent keys get the same credential checks on direct endpoints — An agent API key calling an MCP server's own endpoint now gets the same credential checks as through its agent gateway, so a blocked credential or missing permission is refused there too. (#8355, @danielkov)
• Admin-added static credentials are named correctly in connection choices — Connecting to a server whose only credential is an admin-added static credential now records that credential, so enforcing organizations accept the connection instead of asking you to reconnect. (#8353, @danielkov)
• Gateways report a credential-only server as not signed in — A gateway now reports a member that needs a credential, such as a static credential, as not signed in when you hold none, instead of saying no sign-in is needed. (#8365, @danielkov)
• Whether a server needs upstream sign-in now follows from its credentials — This is derived from the server's auth clients instead of a separate toggle; the old "Needs credentials / Needs none" setting is deprecated and no longer changes anything. (#8329, @danielkov)
• Legacy identity pages keep upstream credentials in step — Removing or changing a client through the older organization identity pages now updates every affected server's upstream credentials immediately, instead of waiting on a later backfill. (#8417, @danielkov)
• Agent API keys reach servers added in Edit — Agents running on an API key no longer stay stuck on their old gateway after you edit them; servers added in Edit now reach the keys they run with, as they already did for workload identity agents. (#8372, @mfbx9da4)
• Tool call logs show which credential signed in — An agent's gateway tool calls now show how Speakeasy signed in upstream: your connection, a teammate's connection, or a shared credential, instead of always crediting the key's creator. (#8370, @mfbx9da4)
• Agent MCP connections show every way an agent signs in — API keys and federated workload sign-ins now show alongside MCP sign-ins, with when a key was last used. (#8309, @mfbx9da4)
• "All servers" agent keys reach servers added later — An agent key issued with "All servers" now reaches MCP servers added after the key was issued, instead of only the servers that existed at the time. (#8341, @mfbx9da4)
• Organization admins can bind shared clients on organization-level servers — Linking or removing an organization-owned identity provider client on a server whose sign-in is organization-level used to always fail; organization admins can now save that change directly. (#8274, @daviddanialy)
• Upstream OAuth migration status reflects settled associations — A gateway member is no longer flagged as needing a client once an administrator has already associated exactly one of the gateway's clients with it. (#8352, @danielkov)