Skip to main content

Passthrough Authentication

With passthrough authentication enabled, authentication to the MCP server acts similarly to the Tableau REST APIs. The same X-Tableau-Auth header used to authenticate to the Tableau REST APIs can also be used to authenticate to the MCP server.

When a request is made to the MCP server, the token is read from the X-Tableau-Auth header, or, when that header is absent, from the workgroup_session_id cookie.

  • When a token is present in either place, the value will be "passed through" and re-used during MCP tool calls when they authenticate to the Tableau REST APIs.
  • When neither is present, behavior depends on how passthrough was enabled:
    • With ENABLE_PASSTHROUGH_AUTH set to true, normal authentication resumes as defined by the AUTH environment variable. This allows clients that provide neither the X-Tableau-Auth header nor the workgroup_session_id cookie to still authenticate to the MCP server.
    • With AUTH set to passthrough, there is no fallback to another AUTH method: the request is rejected with 401 invalid_token.

Warnings​

Credential Lifecycle​

warning

When using passthrough authentication, the calling application is responsible for creating the credential for the X-Tableau-Auth header and managing its lifecycle. The MCP server will not automatically terminate the Tableau session associated with the credential after its use nor will it refresh it after it expires. Providing an invalid or expired credential will result in downstream authentication failures.

Site​

warning

With AUTH=passthrough, SITE_NAME does not restrict which site a token may belong to, and a request without a token is rejected. REST calls and per-site state, such as site settings, use the site part of the token. Site settings are cached under that site only when it matches the session site Tableau validated. The server does not compare the token's site to SITE_NAME.

SITE_NAME applies only to requests with no auth info: PAT, UAT, and direct-trust over HTTP, an embedded-OAuth X-Tableau-Auth request with no access token, and stdio. When ENABLE_PASSTHROUGH_AUTH is set beside OAuth, a request without a passthrough token uses the site of its OAuth token.

JWT Scopes​

warning

If you use a JWT to create the auth token, it must contain the Tableau scopes needed by the underlying REST APIs called by the MCP tools. For the full list of scopes and which are used by each individual tool, please refer to scopes.ts.

In versions of Tableau older than 2026.2, the JWT must also contain the tableau:*:* scope.

OAuth​

warning

When passthrough is enabled as an option with ENABLE_PASSTHROUGH_AUTH and OAuth is the primary AUTH method, all requests to the MCP server must include the X-Tableau-Auth header or authenticate using OAuth. This includes MCP lifecycle requests like the Initialization request, even though it does not make any downstream Tableau REST API calls.

With AUTH=passthrough, OAuth is disabled and there is no OAuth fallback, even if OAUTH_ISSUER remains set from another deployment.

Personal Access Tokens​

danger

Do not use a Personal Access Token (PAT) to generate the X-Tableau-Auth credential when using passthrough authentication since PATs cannot be used concurrently. Signing in multiple times with the same PAT at the same time will terminate any prior session and will result in an authentication error. See Understand personal access tokens for more details.

Environment Variables​

AUTH​

  • Setting AUTH to passthrough enables passthrough authentication and makes it the only accepted method: every request must carry a token in the X-Tableau-Auth header or the workgroup_session_id cookie, and requests without one are rejected with 401 invalid_token.
  • Implies ENABLE_PASSTHROUGH_AUTH is true; you do not need to set both.
  • Requires TRANSPORT to be http; the server refuses to start with stdio.
  • Unlike ENABLE_PASSTHROUGH_AUTH, there is no fallback to another AUTH method when the token is absent.
  • Does not require OAUTH_ISSUER or DANGEROUSLY_DISABLE_OAUTH; a configured OAUTH_ISSUER does not enable OAuth in this mode.

ENABLE_PASSTHROUGH_AUTH​

  • Default: false
  • When true, passthrough authentication is enabled, falling back to the AUTH method when the X-Tableau-Auth header is absent.
  • Only applies when TRANSPORT is http.

PASSTHROUGH_AUTH_USER_SESSION_CHECK_INTERVAL_IN_MINUTES​

  • Default: 10 minutes
  • How often the server re-checks that a passthrough auth token is still valid. Between checks, recently validated tokens are trusted without re-verification. Downstream requests to the Tableau REST APIs could potentially fail if the token was invalidated during this interval.
  • Valid range: 0 to 1440 (24 hours). Use 0 to verify the token on every request.