Cred brokers OAuth for AI agents. Users consent once, agents receive short-lived tokens narrowed to the task, and refresh tokens never leave the vault. Every grant is signed and on record.
$npm install @credninja/sdkHanding an agent a refresh token is the agent-era version of storing passwords in plaintext.
Cred keeps the long-lived credential locked away and issues the agent only what this task needs, for only as long as it needs it.
Configure providers and hand your agent a token. Cred runs the OAuth flow, PKCE and token exchange.
Connects Google, GitHub or Slack once and picks exact scopes. Revocable anytime.
Calls delegate() and gets a short-lived token, never wider than its ceiling. A signed receipt is logged.
Your agent asks for a Google token. Cred verifies the agent, checks consent, decrypts the refresh token in memory, exchanges it, and returns a fresh access token. The refresh token never leaves.
Refresh tokens encrypted at rest with per-account key isolation. AWS KMS HSM for key management.
Ed25519 receipt for every token issuance. Append-only audit trail.
RFC 7636 S256 on every OAuth flow. Cryptographic state prevents CSRF.
Revoke a grant and every agent loses access on its next call.
TypeScript, Python, or straight into Claude Desktop over MCP. Adapters for LangChain, CrewAI, OpenAI Agents, AutoGen and Semantic Kernel.
import { Cred } from '@credninja/sdk'
const cred = new Cred({
agentToken: process.env.CRED_AGENT_TOKEN,
appClientId: process.env.CRED_APP_CLIENT_ID,
})
const { accessToken } = await cred.delegate({
userId,
service: 'google',
scopes: ['calendar.readonly'],
})Open source. Your infra, your KMS, your vault. Every provider and package.
Star on GitHubHosted broker and vault, dashboard, receipt search. Free tier at launch.
Join the waitlist