Module token 

Token passthrough middleware for forwarding client credentials to backends.

When a backend has forward_auth = true, the client’s inbound bearer token is extracted from RouterRequest.extensions and stored as a ClientToken for downstream middleware and backend services to consume.

Configuration

[[backends]]
name = "github"
transport = "http"
url = "http://github-mcp.internal:8080"
forward_auth = true  # forward client's token to this backend

[[backends]]
name = "db"
transport = "http"
url = "http://db-mcp.internal:8080"
bearer_token = "${DB_API_KEY}"  # static token for this backend

How it works

1. The proxy’s auth layer (JWT/bearer) validates the inbound token and stores TokenClaims in request extensions.
2. This middleware reads the TokenClaims and stores the subject (sub claim) and any available identity info as a ClientToken in extensions.
3. Backend-specific middleware or future transport enhancements can read ClientToken to forward credentials.

Structs

ClientToken

A client’s identity token extracted from inbound authentication.

TokenPassthroughService

Middleware that extracts client identity from auth claims and makes it available to backends configured with forward_auth = true.