diff --git a/assets/agw-docs/pages/security/jwt-setup.md b/assets/agw-docs/pages/security/jwt-setup.md
index 4a190a1d9..3e96c1e5e 100644
--- a/assets/agw-docs/pages/security/jwt-setup.md
+++ b/assets/agw-docs/pages/security/jwt-setup.md
@@ -55,7 +55,7 @@ Configure an {{< reuse "agw-docs/snippets/policy.md" >}} to validate JWTs using
| `mode` | Validation mode for JWT authentication. `Strict` requires a valid JWT for all requests. `Optional` validates JWTs if present but allows requests without tokens. `Permissive` is the least strict mode.
Example value: `Strict` |
| `issuer` | The issuer URL that must match the `iss` claim in JWT tokens exactly. Agentgateway rejects tokens from other issuers.{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x" >}} Agentgateway also rejects a token that has no `iss` claim.{{< /version >}}
Example value: `http://keycloak:8080/realms/master` |
| `audiences` | List of allowed audience values. The JWT's `aud` claim must contain at least one of these values. Omit the field to accept any audience.{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x" >}} An empty list also accepts any audience, and a non-empty list rejects a token that has no `aud` claim.{{< /version >}}
Example value: `["my-application"]` |{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x" >}}
- | `preserveToken` | Keeps a validated JWT in the location that it was read from. By default, the gateway removes the token after validation, so the backend does not receive the client's credential. Set this field when another policy on the same route reads the token from the request, such as an OAuth token exchange{{< version include-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x" >}} ([OAuth token exchange]({{< link-hextra path="/documentation/security/backend-authn/oauth-token-exchange/" >}})){{< /version >}}{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x" >}} ([Standard token exchange]({{< link-hextra path="/documentation/security/backend-authn/token-exchange/standard/" >}})){{< /version >}} that takes it as the subject token. When only the backend needs the token, prefer the `passthrough` [backend authentication]({{< link-hextra path="/documentation/security/backend-authn/" >}}) method instead, which does not expose the credential to every policy that runs later.
Example value: `true` |{{< /version >}}
+ | `preserveToken` | Keeps a validated JWT in the location that it was read from. By default, the gateway removes the token after validation, so the backend does not receive the client's credential. Set this field when another policy on the same route reads the token from the request, such as an OAuth token exchange{{< version include-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x" >}} ([OAuth token exchange]({{< link-hextra path="/documentation/security/backend-authn/oauth-token-exchange/" >}})){{< /version >}}{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x" >}} ([Standard token exchange]({{< link-hextra path="/documentation/security/backend-authn/token-exchange/standard/" >}})){{< /version >}} that takes it as the subject token.{{< version exclude-if="1.0.x,1.1.x,1.2.x,1.3.x,1.4.x,1.5.x,1.6.x,2.2.x" >}} In an MCP route, this field also lets an [MCP authentication]({{< link-hextra path="/documentation/security/jwt/mcp/" >}}) policy validate the same token after route-level JWT authentication.{{< /version >}} When only the backend needs the token, prefer the `passthrough` [backend authentication]({{< link-hextra path="/documentation/security/backend-authn/" >}}) method instead, which does not expose the credential to every policy that runs later.
Example value: `true` |{{< /version >}}
| `jwks.remote.jwksPath` | The path to the JWKS endpoint on the identity provider, relative to the backend root. This endpoint returns the public keys used to verify JWT signatures. {{< reuse "agw-docs/snippets/jwks-path.md" >}}
Example value: `/realms/master/protocol/openid-connect/certs` |
| `jwks.remote.cacheDuration` | How long to cache the JWKS keys locally. This setting reduces load on the identity provider and improves performance. Keys are automatically refreshed when the cache expires.
Example value: `5m` (5 minutes) |
| `jwks.remote.backendRef` | Reference to the backend that hosts the identity provider. Agentgateway uses this value to fetch the JWKS keys from the identity provider. For an in-cluster provider, reference a Kubernetes Service. For an external provider that is reached over TLS, reference an {{< reuse "/agw-docs/snippets/backend.md" >}} instead. See [External identity provider over TLS](#external-identity-provider-over-tls).{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x,2026.7.1,2.3.x,2.2.x,2.1.x" >}} Mutually exclusive with `url`. Set exactly one of the two.{{< /version >}}
Example value: The details of the Keycloak service |{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x,2026.7.1,2.3.x,2.2.x,2.1.x" >}}
diff --git a/content/docs/standalone/main/documentation/configuration/security/jwt-authn.md b/content/docs/standalone/main/documentation/configuration/security/jwt-authn.md
index d3e97861f..853142be0 100644
--- a/content/docs/standalone/main/documentation/configuration/security/jwt-authn.md
+++ b/content/docs/standalone/main/documentation/configuration/security/jwt-authn.md
@@ -48,7 +48,7 @@ Additionally, authentication can run in three different modes:
After it validates a token, agentgateway removes the token from the location that it was read from, so that the backend never receives the client's credential. Two settings change that.
-* Set `preserveToken: true` on the `jwtAuth` policy to leave the validated token where it was found. Use this setting when another policy on the same route reads the token from the request, such as an [OAuth token exchange]({{< link-hextra path="/documentation/configuration/security/backend-authn/token-exchange/standard/" >}}) that takes it as the subject token.
+* Set `preserveToken: true` on the `jwtAuth` policy to leave the validated token where it was found. Use this setting when another policy on the same route reads the token from the request, such as an [OAuth token exchange]({{< link-hextra path="/documentation/configuration/security/backend-authn/token-exchange/standard/" >}}) that takes it as the subject token. In an MCP route, this setting also lets `mcpAuthentication` validate the same token after `jwtAuth` validates the token.
* Set the `passthrough` [backend authentication]({{< link-hextra path="/documentation/configuration/security/backend-authn/" >}}) method to forward the validated token to one backend. Prefer this form when only the backend needs the token, because it does not expose the credential to every policy that runs later.
{{< tabs >}}
diff --git a/content/docs/standalone/main/release-notes/release-notes.md b/content/docs/standalone/main/release-notes/release-notes.md
index 4645e06f4..f40712cf5 100644
--- a/content/docs/standalone/main/release-notes/release-notes.md
+++ b/content/docs/standalone/main/release-notes/release-notes.md
@@ -32,6 +32,7 @@ Review the release notes for agentgateway standalone.
+
**Traffic management**
@@ -50,6 +51,7 @@ Review the release notes for agentgateway standalone.
- Stateful MCP requests with a session ID that the proxy cannot decode, such as after the session key changes, now return `404` instead of `400`, so clients start a new session.
- MCP authentication derives JWKS URLs without a double slash when an issuer value ends with `/`.
- MCP streamable HTTP `POST` requests can list `application/json` and `text/event-stream` in separate `Accept` header lines instead of one comma-separated value.
+- MCP authentication can validate a request after route-level JWT authentication when the route JWT policy keeps the original token with `preserveToken: true`, and strict mode rejects only when the token is unavailable.
**Operations**