External URL server with API key auth — gateway returns "Missing Authorization header"

[chicogonzales]

I published an external URL server (plith/plith) with x-api-key configured
as a required header parameter. The publish preview shows correct forwarding.

When calling the gateway directly, I get:

{"error":"invalid_token","error_description":"Missing Authorization header"}

I understand the gateway may require its own OAuth layer before proxying.
However, the OAuth connection flow also fails:

https://api.smithery.ai/connect/plith/plith/auth
→ "Connection failed - We couldn't authenticate with the upstream server."

So neither path works:

1. Direct gateway call with x-api-key → rejected (expects OAuth)
2. OAuth connect flow → fails to authenticate with upstream

Direct access to the server works fine with the x-api-key header.

Server: plith/plith
Listing: https://smithery.ai/servers/plith/plith
Gateway: https://plith--plith.run.tools
Direct: https://plith.ai/api/mcp

Is there a step I'm missing for external URL servers with API key auth?
Or is this a known limitation of the gateway?

Workaround: Users connect directly to the server URL.

[chicogonzales]

Confirmed still occurring as of today (April 14). Both auth paths fail:

API key as header — gateway ignores it, demands OAuth Bearer token
curl -H "x-api-key: [valid-key]" https://plith--plith.run.tools
→ 401: {"error":"invalid_token","error_description":"Missing Authorization header"}

API key as query param (per server config schema) — same result
curl "https://plith--plith.run.tools?x-api-key=[valid-key]"
→ 401: same

OAuth connect flow — still fails
https://api.smithery.ai/connect/plith/plith/auth → "Connection failed"

The gateway's OAuth layer intercepts all requests before they reach the upstream server, so API key auth can't work through the gateway at all.

Direct endpoint (plith.ai/api/mcp) works fine with the same key.

Is API key auth (non-OAuth) a supported auth method for external URL servers on the gateway? If not, what's the recommended auth approach for servers that use API keys rather than OAuth?