# Show HN: Secure Bearer JWT and JWKS pattern for headless AI agents (MCP #824)

> Source: <https://github.com/orgs/modelcontextprotocol/discussions/824>
> Published: 2026-07-31 11:17:59+00:00

# Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path) #824

[Mawyxx](/Mawyxx)started this conversation in

[Show and tell](/orgs/modelcontextprotocol/discussions/categories/show-and-tell)

## Pre-submission Checklist
## What would you like to share?## Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path)Headless agents calling MCP tools usually get one of two defaults — both fail a serious threat model:
That’s what ## Static key vs human OAuth vs JWKS passport
## Minimal wire

```
Agent host:     opaque mint secret (env / secret manager)  →  never sent to MCP
Agent → LIME:   mint RS256 JWT { aud=mcp, domain=<mcp-host>, TTL≈minutes }
Agent → MCP:    Authorization: Bearer <jwt>
MCP RS:         JWKS verify → authorize by sub
```

 Gate behind env (
If static keys already match the threat model, ignore. If agent auth is heading into review, this is the pattern that usually survives it. ## Relevant Links
|