Authsome gives agents a single place to log in, keep credentials encrypted, and refresh access when a tool runs. It works as a CLI plus auth proxy, so you can set it up once and then run agent tasks headlessly without exposing tokens to the agent process.
Builders who want their agents to reach GitHub, Gmail, Stripe, and similar services without copying credentials into every project.
You can let agents use external services headlessly while keeping your credentials out of the agent process.
Logs in once and stores access for later runs through bundled provider support.
Injects fresh credentials at request time so child processes do not see secrets in environment variables.
Supports unattended agent runs in CI, SSH sessions, cron jobs, and background workers.
Provides adapters for Claude Code, Codex, Cursor, OpenCode, LangChain, LlamaIndex, and SDKs.
Can run as a persistent Docker service with Postgres, master key, and UI session key configuration.
uv tool install authsome
authsome onboard
authsome onboard --base-url https://authsome.example.com
npx skills add agentrhq/authsome
Star the repo agentrhq/authsome
Get my last 5 emails from gmail
Credential Gateway for AI Agents
Docs · Website · Discord · Issues
An open-source credential gateway that sits between your agents and the services they call. Instead of sharing credentials with every agent, log in once via OAuth2 or API keys. Authsome stores credentials securely and injects them via an HTTP proxy. You get one place to manage access, rotate keys, and see what every agent is doing.
Bundled providers out of the box — OAuth2 and API key. See the full list.
https://github.com/user-attachments/assets/27f9b229-baf4-4889-be9a-378a133654dc
Agents run beyond interactive sessions. They live in CI, over SSH, in cron jobs, in background workers, and in parallel pipelines. They need API access that survives without a human in the loop.
Hardcoded environment tokens leak or go stale, and building auth flow logic, token storage, refresh handling, and per-provider config into every project rebuilds the same plumbing every time.
Authsome is the credential broker agents call at runtime.
The CLI is the agent's interface: setup once, then inject fresh credentials whenever a tool runs.
Authenticate once:
authsome login github
# This opens a browser on user's machine
# user completes login without sharing the creds with the agent.
Then agents get valid credentials on demand when they try to access external services.
All they need to do is use authsome run -- before the command they want to run:
authsome run -- curl -s "https://api.github.com/user/repos?per_page=10"
# runs behind an auth proxy that injects headers at request time
# without exposing secrets in the child process environment.
# matched automatically via provider api_url (e.g. api.openai.com)
Credentials are encrypted at rest and refreshed before expiry.
| authsome | Hardcoded env tokens | DIY | |
|---|---|---|---|
| Automatic token refresh | ✅ | ❌ | build it |
| OAuth2 + API keys | ✅ | ❌ | build it |
| Runtime headless use | ✅ | ✅ | varies |
| Built-in providers, zero config | ✅ | ❌ | ❌ |
| Multi-account per provider | ✅ | ❌ | build it |
| Agents never see credentials | ✅ | ❌ | build it |
Authsome gives agents one command for a valid token, without scattering long-lived secrets across every project.
Requires Python 3.13+.
uv tool install authsome
Run a persistent daemon in Docker — no Python required on the host:
export AUTHSOME_POSTGRES_PASSWORD="$(openssl rand -hex 24)"
export AUTHSOME_MASTER_KEY="$(openssl rand -base64 32)"
export AUTHSOME_UI_SESSION_KEY="$(openssl rand -base64 32)"
docker compose up -d
curl http://localhost:7998/health
For a hosted daemon, set AUTHSOME_BASE_URL to the public HTTPS URL before starting the stack. See the self-hosting guide for first-run setup, volume backup, TLS termination, and environment variable reference.
Install and run first-time setup (identity, claim, and API key import from .env):
authsome onboard
For a remote daemon, pass --base-url once — it is saved in client config for later commands:
authsome onboard --base-url https://authsome.example.com
Add the authsome skill to your agent (claude, codex, cursor, hermes, etc.):
npx skills add agentrhq/authsome
And try a sample task that requires access to external services:
Star the repo agentrhq/authsome
Get my last 5 emails from gmail
Check my stripe balance
The agent will use authsome to login into external services and perform the task.
Authsome ships with adapters for the most common agent frameworks and CLIs:
Full list at authsome.ai/docs/integrations.
See authsome.ai/docs/roadmap for what's shipped, what's next, and what's out of scope.
MIT. See LICENSE.
Sign in to join the discussion.
No comments yet. Be the first to say what this is good for.
High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 158 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.
Universal provider proxy for OpenAI Codex & Claude Code — use any LLM (Claude, Gemini, Grok, DeepSeek, Ollama…) with Codex CLI, App, SDK, and Claude Code
Git-native persistent memory for AI coding agents. Implements Google OKF v0.2 with sub-300µs in-memory BM25 search, embedded MCP server, and progressive disclosure. Slashes token bloat by 80% with zero external databases or dependencies. Built in pure Go.
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
20 MB lightweight cross-platform database client for 90+ databases, including MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, and Dameng. Built-in AI, MCP Server, CLI, desktop and Docker. | 轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 90+ 数据库，提供桌面端、Docker、CLI、内置 AI 助手和 MCP Server。