how does "x-supabase-access-token" get added to the config

[Courvoisier13]

Hi,
I am using this example code to implement a custom authentication using firebase but I do not have an MCP. The get_current_user function in auth.py gets the token gets the user_id and verifies the token.
however, in the node, the config.get("configurable", {}) does not have any firebase tokens. I found that the key "x-supabase-access-token" is coming from open-agent-platform.

1. Wouldn't that constitute a security vulnerability? The langgraph platform removes the Authorisation from the config, and yet here we are sending the token under a different name.
2. What can we do otherwise, if we need the tokens in the nodes?
   thank you