Document Kubernetes static auth and DCR

[danbarr]

Description

Documents the supported Kubernetes authentication paths for static backend credentials and upstream Dynamic Client Registration (DCR).

• Documents headerForward for proxy-specific headers and MCPExternalAuthConfig bearerToken for bearer tokens shared by multiple MCPRemoteProxy resources.
• Clarifies that vMCP, rather than MCPServer, performs headerInjection when it discovers the reference on a backend.
• Documents upstream OAuth 2.0 DCR discovery and direct registration endpoints, validation constraints, initial access tokens, and Redis persistence behavior.
• Restructures the embedded authorization server guide so the five-step baseline is separate from optional client registration, upstream provider, session storage, and outgoing authentication settings.
• Distinguishes MCP clients registering with ToolHive from ToolHive registering with an upstream OAuth provider, and links to the working Notion example.

Type of change

• Documentation update

Related issues/PRs

Closes #1013 based on revised scope. bearerToken works with MCPRemoteProxy, while headerInjection remains specific to vMCP outgoing authentication.

Closes #1021

Screenshots

Not applicable. No visual layout or navigation changes.

Submitter checklist

Content and formatting

• I have reviewed the content for technical accuracy
• I have reviewed the content for spelling, grammar, and style

Reviewer checklist

Content

• I have reviewed the content for technical accuracy
• I have reviewed the content for spelling, grammar, and style

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview, Comment	Jul 22, 2026 12:32pm

[Copilot]

Pull request overview

This PR updates the Kubernetes documentation to close two known gaps: (1) proxy-layer static backend credential injection via MCPExternalAuthConfig (headerInjection / bearerToken), and (2) embedded authorization server upstream Dynamic Client Registration (DCR) configuration and operational implications.

Changes:

• Added a worked “Inject static backend credentials” section to the Kubernetes auth guide, including MCPServer/MCPRemoteProxy references to shared MCPExternalAuthConfig.
• Restructured the embedded authorization server Kubernetes guide to separate baseline setup from optional client registration, Redis-backed session/DCR persistence, and upstream provider configuration.
• Documented upstream OAuth 2.0 DCR usage (discoveryUrl vs direct registrationEndpoint), constraints, optional fields, and persistence behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
docs/toolhive/guides-k8s/remote-mcp-proxy.mdx	Adds a cross-link steering single-header static credentials to MCPExternalAuthConfig instead of headerForward.
docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx	Expands and reorganizes embedded auth server guidance, including upstream DCR configuration and Redis persistence implications.
docs/toolhive/guides-k8s/auth-k8s.mdx	Adds a new proxy-layer static backend credential injection section with worked YAML examples and cross-links.