Loading...
Delegation, not exposure.
Open-source, self-hosted credential delegation for AI agents. Cred brokers OAuth tokens so agents get short-lived credentials while refresh tokens stay locked in the vault.
Three actors, one secure handshake
Deploy the self-hosted broker, configure your OAuth providers (Google, GitHub, Slack, etc.), and hand your agent a bearer token plus server URL. Cred handles the authorization flow, PKCE, and token exchange.
The user connects their Google/GitHub/Slack account through a standard OAuth flow. They choose exactly which scopes to grant to your app. Revocable anytime.
Your agent calls cred.delegate() and receives a short-lived access token. The refresh token never leaves the vault. Cryptographic receipts log every delegation.
Seven steps from request to token. Watch the data flow.
Your agent asks Cred for a Google token. Cred verifies the agent, checks consent, decrypts the refresh token from the vault, exchanges it for a fresh access token, and hands it back. The refresh token never leaves the vault. Total time: ~150ms.
Refresh tokens encrypted at rest with per-account key isolation. AWS KMS HSM for key management.
Ed25519-signed receipts for every token issuance. Append-only cryptographic audit trail.
RFC 7636 PKCE S256 for all OAuth flows. Cryptographic state prevents CSRF.
Revoke access anytime. Tokens invalidated immediately across all agents.
Seven adapters and counting.
Ship the feature, not the plumbing.
Read the docs, try the sandbox, or browse the source.