---
title: Service token support for MCP server portals
description: You can now use an Access service token to connect autonomous agents and bots to an MCP server portal with full access to upstream MCP servers.
image: https://edgetunnel-b2h.pages.dev/changelog-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

[ ← Back to all posts ](https://edgetunnel-b2h.pages.dev/changelog/) 

## Service token support for MCP server portals

Jun 26, 2026 

[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) 

You can now connect autonomous agents and bots to an [MCP server portal](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) using an [Access service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/). Service token sessions can reach upstream MCP servers through the portal without a browser-based OAuth flow.

To set this up:

* Add a [Service Auth policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#service-auth) that matches your service token to the portal's Access application.
* Add a Service Auth policy that matches the same token to each linked MCP server's Access application.
* Turn **Require user auth** off (`on_behalf: false`) for each linked server so the portal uses the admin credential instead of a per-user OAuth grant.

The bot connects with `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers and sees the tools from every linked server it is authorized for. Servers that still require per-user OAuth are excluded from service token sessions because a service token cannot complete a per-user OAuth grant.

For step-by-step setup, refer to [Connect with a service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token).

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-26-mcp-portal-service-tokens/#page","headline":"Service token support for MCP server portals · Changelog","description":"You can now use an Access service token to connect autonomous agents and bots to an MCP server portal with full access to upstream MCP servers.","url":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-26-mcp-portal-service-tokens/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/changelog-preview.png","dateModified":"2026-06-26","datePublished":"2026-06-26","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```