fix(ui): expose the authorization MCP auth type in the create and edit forms

[devin-ai-integration]

TLDR

Problem this solves:

• UI cannot configure auth_type: authorization MCP servers
• Backend accepts it; only the management API could reach it
• Upstreams needing Authorization: ApiKey <key> return 401 via api_key

How it solves it:

• Add "Authorization (raw header)" to both auth dropdowns
• Treat it as an auth-value mode so the value field renders
• Render the auth Selects unvirtualized so every option is reachable

Relevant issues

Fixes #34763

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

I don't have UI screenshots to attach; the change is dropdown-only, so here is the click path to capture before/after at 153b17e98b

1. Start the proxy: python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log, and the dashboard dev server: npm run dev in ui/litellm-dashboard
2. Go to http://localhost:3000/ui/?page=mcp-servers and click "Add New MCP Server"
3. Pick "Streamable HTTP" as the transport, then open the Authentication section: before this PR the dropdown stops at None / API Key / Bearer Token / Token / Basic Auth / OAuth / OAuth Token Exchange / AWS SigV4 / True Passthrough / OAuth Delegate; after it also lists "Authorization (raw header)"
4. Select it, put ApiKey <upstream key> in Authentication Value, point the URL at an upstream that wants a non-preset scheme (the reporter's case is an Elastic Kibana Agent Builder MCP at /api/agent_builder/mcp), and hit "Add MCP Server"
5. Confirm the row saves with auth_type: authorization and that listing tools succeeds where the api_key option previously returned 401, e.g. curl -sS -X POST http://localhost:4000/v1/mcp/server -H "Authorization: Bearer sk-1234" ... returns the same shape the form now sends
6. Reopen the server in the edit drawer and confirm the dropdown shows the saved value rather than falling back to a blank selection

Type

🐛 Bug Fix

Changes

AUTH_TYPE in ui/litellm-dashboard/src/components/mcp_tools/types.tsx gains AUTHORIZATION: "authorization", mirroring MCPAuth.authorization, which the client already turns into a verbatim headers["Authorization"]. Both create_mcp_server.tsx and mcp_server_edit.tsx add the option to the auth-type Select and add AUTH_TYPE.AUTHORIZATION to AUTH_TYPES_REQUIRING_AUTH_VALUE, which also pulls it into AUTH_TYPES_REQUIRING_CREDENTIALS so the entered value is collected into credentials.auth_value. The BYOK hint in the create form already described this mode (Authorization: {key}), so it now matches what the dropdown offers

Both auth Selects also get virtual={false}. antd virtualizes the option list at roughly a 256px window, so the eleventh option pushed OAuth Delegate out of the rendered DOM and the existing tests that select it started failing; with a fixed list of eleven static options the virtual list buys nothing and costs reachability

Regression coverage: create_mcp_server.test.tsx picks the new option and asserts the create payload carries auth_type: "authorization" plus credentials.auth_value, and mcp_server_edit.test.tsx does the same for a save that switches an existing api_key server over. Both fail without the dropdown entry (the option can't be selected) and without the auth-value wiring (no value field to type into)

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/0f93b8ddb8aa4b6785f272645153e5d6

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

Adds raw Authorization-header authentication to MCP server management forms

• Exposes the authorization auth type in create and edit dropdowns
• Sends entered raw header values through credentials.auth_value
• Disables Select virtualization so all authentication options remain reachable
• Adds create, edit, and shared-type regression coverage

Confidence Score: 4/5

The blank-value transition into Authorization needs to be fixed before merging because it saves the new auth type without a usable credential

The edit form allows a server to switch to Authorization without entering an auth value; its payload then omits credentials and the backend clears them during the auth-class change, leaving authenticated upstream calls without the required header value

Files Needing Attention: ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.tsx

Important Files Changed

Filename	Overview
ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/create_mcp_server.tsx	Exposes the authorization option and includes its raw header value in create payload credentials
ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.tsx	Adds raw Authorization editing, but permits switching into the mode without supplying the required credential
ui/litellm-dashboard/src/components/mcp_tools/types.tsx	Adds the backend-supported authorization value to the shared frontend auth-type constants
ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/create_mcp_server.test.tsx	Verifies create-form selection, value entry, and payload serialization for raw Authorization
ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.test.tsx	Verifies saving a supplied raw Authorization credential but does not cover switching with a blank value

_{Reviews (1): Last reviewed commit: "fix(ui): expose the authorization MCP au..." | Re-trigger Greptile}

[greptile-apps]

Authorization saves without credentials

When an admin switches an existing server to Authorization and leaves the newly displayed value blank, the form omits credentials while saving the new auth type; the backend clears credentials on that auth-class change, leaving the server configured for Authorization without an auth_value and causing authenticated upstream requests to fail. Require a value when switching into this mode while retaining the blank-means-keep-existing behavior for servers already using it