diff --git a/auth/bearer.go b/auth/bearer.go
index 85d0cac..3761223 100644
--- a/auth/bearer.go
+++ b/auth/bearer.go
@@ -176,6 +176,15 @@ func tokenType(raw string) string {
 	}
 }
 
+// Fingerprint is the exported form, for servers that authenticate on a path this
+// middleware does not own — gitea-mcp's PAT pass-through, which runs ahead of
+// BearerMiddleware and emits its own `mcp auth accepted` line.
+//
+// Exported rather than reimplemented per consumer: two different fingerprints
+// for the same token across two log lines cannot be correlated, which is the
+// entire purpose of the field.
+func Fingerprint(raw string) string { return fingerprint(raw) }
+
 // fingerprint is a short, non-reversible correlator (truncated SHA-256) so ops
 // can group repeated attempts from one client without ever logging token bytes.
 func fingerprint(raw string) string {