Enum UpstreamAuth 

pub enum UpstreamAuth {
    Bearer {
        sealed_secret_ref: String,
    },
    Header {
        header_name: String,
        sealed_secret_ref: String,
    },
    EnvVar {
        env_var_name: String,
        sealed_secret_ref: String,
    },
    QueryParam {
        param_name: String,
        sealed_secret_ref: String,
    },
}

How the operator’s upstream credentials are injected into an MCP invocation. The actual secret is NOT stored in this struct — it is stored separately by the node in a sealed credential vault, keyed by sealed_secret_ref. The operator’s secret is fetched only at invocation time and zeroized after the request completes.

Tenants who present a Tenzro API key never see sealed_secret_ref or the underlying secret. They see only the MCP’s response payload.

Variants

Bearer

Authorization: Bearer <secret> header on the outbound request.

Fields

sealed_secret_ref: String

Opaque reference into the operator’s sealed credential vault. The node maps this to the actual secret at invocation time.

Header

Arbitrary header injection: <header_name>: <secret>.

Fields

header_name: String

sealed_secret_ref: String

EnvVar

For stdio MCPs only: secret is injected as an environment variable in the spawned subprocess. Common for npm-package MCPs that expect e.g. OPENAI_API_KEY, STRIPE_API_KEY, etc.

Fields

env_var_name: String

sealed_secret_ref: String

QueryParam

Query-string parameter on the endpoint URL (rare; some legacy services). Discouraged for new integrations because of URL logging concerns, but supported for completeness.

Fields

param_name: String

sealed_secret_ref: String

Implementations

impl UpstreamAuth

pub fn sealed_secret_ref(&self) -> &str

Returns the sealed-secret reference for vault lookup.

Trait Implementations

impl Clone for UpstreamAuth

fn clone(&self) -> UpstreamAuth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UpstreamAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for UpstreamAuth

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for UpstreamAuth

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.