> ## Documentation Index
> Fetch the complete documentation index at: https://docs.consensus.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure API Management

> Expose the Consensus MCP server through Azure API Management as a passthrough MCP server, with a bearer token injected by policy.

Azure API Management can front an external MCP server as a passthrough resource, so your agents call your APIM instance and it forwards to Consensus. Available on Developer, Basic, Basic v2, Standard, Standard v2, Premium, and Premium v2 tiers.

## Register the server

<Steps>
  <Step title="Create the MCP server">
    In the Azure portal open your API Management instance, go to **APIs › MCP servers**, select **+ Create MCP server**, then **Expose an existing MCP server**.
  </Step>

  <Step title="Backend MCP server">
    | Field                   | Value                           |
    | ----------------------- | ------------------------------- |
    | **MCP server base URL** | `https://mcp.consensus.app/mcp` |
    | **Transport type**      | Streamable HTTP (the default)   |
  </Step>

  <Step title="New MCP server">
    Set **Name** to Consensus, a **Base path** such as `consensus`, and a **Description**. Assign **Products** and select **Create**.
  </Step>
</Steps>

## Authentication

<Tabs>
  <Tab title="Bearer (shared)">
    Store your Consensus API key as a secret Named Value (for example `consensus-api-key`) and add an inbound policy on the MCP server:

    ```xml theme={null}
    <set-header name="Authorization" exists-action="override">
        <value>@("Bearer " + "{{consensus-api-key}}")</value>
    </set-header>
    ```
  </Tab>

  <Tab title="OAuth (per user)">
    Use Credential manager with a confidential client from Consensus ([contact sales](https://consensus.app/home/contact/sales/); APIM doesn't do Dynamic Client Registration). Then inject the user's token:

    ```xml theme={null}
    <get-authorization-context
        provider-id="consensus"
        authorization-id="auth-01"
        context-variable-name="auth-context"
        identity-type="managed"
        ignore-error="false" />
    <set-header name="Authorization" exists-action="override">
        <value>@("Bearer " + ((Authorization)context.Variables.GetValueOrDefault("auth-context"))?.AccessToken)</value>
    </set-header>
    ```
  </Tab>
</Tabs>

## Notes

* A `401` from the backend usually means the `Authorization` header wasn't forwarded; check the `set-header` policy.
* Don't read `context.Response.Body` in MCP server policies; buffering the body breaks the response stream.
* APIM requires the backend to speak MCP `2025-06-18` or later.

Microsoft docs: [Expose an existing MCP server](https://learn.microsoft.com/en-us/azure/api-management/expose-existing-mcp-server) · [Secure MCP servers](https://learn.microsoft.com/en-us/azure/api-management/secure-mcp-servers)