Authsome

Authsome is a credential broker designed for AI agents that require secure, persistent access to APIs across various environments. It addresses the challenge of managing authentication for agents running outside interactive sessions—such as in CI pipelines, cron jobs, SSH sessions, background workers, or parallel processes—where manual credential input is not feasible and hardcoded tokens are prone to leaking or expiring.

The platform allows users to authenticate once with a provider, such as GitHub, Google, OpenAI, Linear, or among 41 other bundled services, using OAuth2 or API keys. After this initial setup, Authsome keeps credentials up-to-date for every subsequent agent run. Credentials are stored in an encrypted vault, and the system automatically refreshes them before expiry. When an agent runs, Authsome injects the necessary authentication headers transparently through a proxy, ensuring that raw secrets are not exposed to the child process. This setup eliminates the need for embedding authentication logic, token storage, refresh handling, or per-provider configuration within each project, centralizing credential management in a single, encrypted store.

Authsome is delivered as a self-hosted daemon, meaning there is no dependency on a third-party SaaS and credentials remain under the user's control. The primary interface is a command-line tool (CLI), which agents use to interact with the credential broker. Setup can be performed through a browser-based PKCE flow for OAuth2 providers, through a secure browser bridge for API key services, or headlessly via device code flow for environments like SSH or CI. Users can also add custom OAuth2 or API-key providers beyond those bundled with Authsome.

The architecture of Authsome includes five layers—identity, policy, vault, auth, and audit—tied together by a proxy. It supports multi-account use per provider, and is designed for scenarios where agents must operate headlessly and securely without manual intervention.