Forwarding Microsoft EntraID (Azure AD) JWTs from LibreChat's 'Reuse Token' Flow to a Custom FastAPI Endpoint

[Sanady]

How to pass Entra ID JWT tokens from LibreChat "Reuse Token" to custom endpoint API?

Context

I'm trying to integrate LibreChat with a custom endpoint API that needs to authenticate users using Entra ID (Azure AD) JWT tokens. I've configured LibreChat with Microsoft authentication and enabled the "Reuse Token" feature, expecting to receive the original JWT access/refresh tokens in my custom endpoint.
 

Problem

While I can see in the browser's network tab that LibreChat successfully receives the proper Entra ID JWT tokens during authentication, when these tokens reach my custom endpoint API, they appear to be different - seemingly opaque tokens rather than the original JWTs.
 

What I've tried

• Enabled "Reuse Token" feature in LibreChat configuration
• Verified that Entra ID authentication is working (can see JWT tokens in browser)
• Attempted to read tokens from both Authorization header and cookies in my custom endpoint
• Inspected the tokens received by my API - they don't match the JWT format/content visible in browser
   

Questions

• How should LibreChat be configured to pass through the original Entra ID JWT tokens to custom endpoints?
• What header or cookie should my custom endpoint API expect to receive the JWT tokens in?
• Is there additional configuration needed on either LibreChat or Entra ID side to enable JWT passthrough?
• Are there any transformations LibreChat applies to tokens before sending them to custom endpoints?
   

Configuration Details

• LibreChat version: latest dev commit (0.7.8+)
• Authentication provider: Microsoft Entra ID
• Custom endpoint implementation: FastAPI
• "Reuse Token" feature: Enabled
   

Expected Behavior

My custom endpoint should receive the original JWT access token (and optionally refresh token) issued by Entra ID, allowing it to:
 

• Validate the token signature
• Extract user claims (email, roles, etc.)
• Make authenticated calls to Microsoft Graph API on behalf of the user
   

Actual Behavior

The token received by my custom endpoint appears to be an opaque/session token rather than the original JWT, preventing proper validation and user identification.
 
Has anyone successfully implemented this flow? Any guidance on the correct configuration or token handling would be greatly appreciated!

Already discussed in issue #7769

[nthe]

+1

I’m also interested in this. I’ve went through documentation and it seems like there are header placeholders for various user properies (found in MCP headers docs). @danny-avila Is there a way to create one for JWT token as well?

I’m pretty sure having this feature would help adopting LibreChat in orgs running on Azure.

[danny-avila]

if all that is needed is the JWT token, then yes we can create something like this.