MCP header propagation documentation missing

[stevehaertel]

Bug Description

@erichare @lice-reis @andifilhohub
The bug #12529 was resolved.

I did some testing and here is how it now works:

1. The user must add the string x-api-key as both the key and the value in the headers section of the MCP component
2. The user sets ... "x-api-key", "[actual_key]" ... in the args of their mcp server json in their client.
3. With the updated code as delivered by this pr, the MCP component in the flow will first look up the value of the header, in our case, "x-api-key" and it will find it in the request_headers and it will use that if it's there. If not, it will use the literal string.

This works in both cases, but there are some gaps that we need to close.

1. Documentation gap: The current documentation page mcp-client.mdx does not explain how this new "feature" works, so we should update that.
2. Security warning: There is no problem right now in the code, but what happens right now is it takes the value and then looks inside the request_headers for the string value that the user put in their MCP component. If they put an actual secret in that value, the code looks in the request_headers to see if there is a key equal to the secret value. I don't think anything is potentially logged, but I want to call out that we need to be careful here to handle any possible exceptions in that part of the code so that the user's secret doesn't leak into logs potentially.

This issue I opened is mainly to close the documentation gap to explain what someone needs to do if they want to use the x-api-key in an external mcp config 👍🏻

Thanks everyone~!

Reproduction

Same steps as: #12529

Expected behavior

Documentation updated to explain the requirements of the new feature.

Who can help?

No response

Operating System

Any

Langflow Version

1.10.0

Python Version

3.12

Screenshot

No response

Flow File

No response

[AntonioABLima]

Hey @stevehaertel! Great catch, and thanks for taking the time to test this so thoroughly and write it up so clearly!

I've flagged this to our technical writer @mendonk to update mcp-client.mdxwith a dedicated section explaining the x-api-key propagation pattern, the opt-in config ({"x-api-key": "x-api-key"}), and the full nested-MCP scenario.

Thanks for helping make Langflow better!

[AntonioABLima]

LE-1268

[AntonioABLima]

Thank you for your time and effort in putting this report together! Since PR #13396 has been merged, I am closing this issue as fixed.

Thanks for improving Langflow docs! 🚀

[stevehaertel]

Thanks @AntonioABLima !

Are the headers case-sensitive? I ask because the code handles authorization (with a small a) and the updated docs use a capital A

Should we update to switch that with a small a or does it not matter from the code point of view?

[mendonk]

Langflow will accept any combination of capitalization for the header names, because FastAPI request.headers normalizes the lookup, and it's an HTTP convention.
The default token header is Authorization (here in main, but moved to langflow/src/lfx/src/lfx/services/settings/auth.py for 1.11).