Oki. Yeah it's a bit annoying the way to get this to work at the moment. We are tracking improvements to support this use case, I've mentioned your case in our internal tracker 😊 .
The way to get this to work it to configure the agent client to authenticate via a bearer token, and passing a SA token to that.
If you use claude code or codex you can auth the MCP server with your SA token directly:
export MOTHERDUCK_TOKEN='<your-SA-token>'
codex mcp add motherduck-sa \
--url https://api.motherduck.com/mcp \
--bearer-token-env-var MOTHERDUCK_TOKEN
claude mcp add --transport http --scope user \
motherduck-sa https://api.motherduck.com/mcp \
--header 'Authorization: Bearer ${MOTHERDUCK_TOKEN}'
For Claude GUIs (desktop, web) you can also add a custom connector if your account supports configuring request headers.
1. On Customize > Connectors > Add custom connector.
2. Enter https://api.motherduck.com/mcp.
3. Choose No sign-in.
4. Under Request headers, add:
◦ Name: Authorization
◦ Value: Bearer <your-SA-token>
5. Save.
If your account doesn't support the headers yet, for Claude Desktop only it's also possible to add a local redirect by adding the following to your claude_desktop_config.json.
"mcpServers": {
"MotherDuck (prod)": {
"command": "npx",
"args": [
"mcp-remote",
"https://api.motherduck.com/mcp",
"--header",
"Authorization: Bearer <your-SA-token>"
]
}
},
Finally (😅), for ChatGPT you need to create a custom MCP app (docs), and choose "Access token /API key" auth method. I think that option might only be available for some accounts though...