Multi-tenant agents: one key, many users

A delegated access key lets one agent serve many organizations and end users without minting a key per customer. The key carries no fixed org or user; you bind those per request with headers.

The headers

• Authorization: Bearer ucl_<key> - your delegated agent key.
• X-Org-Id: <org> - which workspace/tenant the call is for. Required for delegated keys.
• X-User-Id: <end-user> - the end user to act as on per-user connectors.

One client per end user

Construct one MCP client per end user and bind the headers at connect time. The same key serves every tenant; org-level connectors use the org credential, per-user connectors act as the X-User-Id.

from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "ucl": {
        "transport": "streamable_http",
        "url": "https://your-company.ucl.dev/mcp",
        "headers": {
            "Authorization": "Bearer ucl_<delegated-key>",
            "X-Org-Id": "acme",
            "X-User-Id": "user@acme.com",
        },
    }
})