Unifies first-run setup into a single idempotent command that registers
identity, completes claim, and imports API keys from env. Persists
--base-url in client config for remote daemon connections.
Closes#434
Co-authored-by: Cursor <cursoragent@cursor.com>
Enables single-command self-deployment of the authsome daemon in a
container without requiring Python or uv on the host.
- Multi-stage Dockerfile: ui-builder (Node 24/pnpm) → py-builder (uv
wheel) → slim Python 3.13 runtime, non-root authsome user
- docker-compose.yml with named volume and restart: unless-stopped
- .dockerignore to keep the build context minimal
- docs/guides/self-hosting.md covering quick-start, env vars, volume
backup/restore, TLS with Caddy, and local builds
- .github/workflows/docker.yml CI job that builds the image on every PR
- README.md self-hosting quick-start section
Closes#366
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The earlier audit surfaced contradictions between docs and code that
were verified against agentrhq/authsome main at 3929b86. This fixes
the verified gaps; the rest is tracked for follow-up PRs.
Provider count: source has 45 JSONs (14 OAuth2 + 31 API key) in
src/authsome/auth/bundled_providers/. Notion ships as two entries
(notion + notion_dcr) and Klaviyo as two (klaviyo + klaviyo-oauth).
- README.md: 44 -> 45 and 13 OAuth -> 14 OAuth.
- .claude-plugin/marketplace.json: same correction in the plugin
description.
Master key path: paths.py routes the server master key to
~/.authsome/server/master.key, confirmed by vault/crypto.py and
health.py. Three doc pages had the wrong (top-level) path.
- security/threat-model.mdx: data-at-rest table and offline-disk
paragraph.
- security/encryption.mdx: local_key backend description.
- troubleshooting/doctor.mdx: both accordion FAIL examples and the
chmod remediation. Also points users at "authsome init" instead of
the side-effect-on-first-run workaround.
- concepts/credential-storage.mdx: local_key backend description.
- concepts/architecture.mdx: vault wrapping description.
Architecture layer status: src/authsome/ ships identity/ (Ed25519
keys, did:key DIDs, PoP JWT), audit/ (structured JSON events), in
addition to vault/ and auth/. Only policy/ is still planned.
- concepts/architecture.mdx: replace the "alpha focuses on Vault and
Auth" Note with a per-layer status table reflecting reality. Also
updates the SQLite backend description to the kv_store path
(~/.authsome/server/kv_store/) consistent with the canonical
filesystem layout.
Hosted daemon cross-reference: changelog 0.2.4 ships
AUTHSOME_DAEMON_URL and AUTHSOME_SERVER_BASE_URL, but the threat
model classifies hosted daemons as "Caveat (VPN only)" for private
and "No" for public. Cross-reference added to the changelog entry so
adopters see the constraint at the point of the feature
announcement.
Domain: README links updated from authsome.agentr.dev to
authsome.ai for consistency with the docs canonical URL fixed in
#271.
Out of scope (separate follow-ups):
- Profile-as-folder trees in credential-storage.mdx and
profiles-vs-connections.mdx still show profiles/<name>/store.db,
which conflicts with the new server/kv_store/ architecture. Needs
a dedicated rewrite of those pages.
- mitmproxy CA install procedure (10 pages mention it; none have an
install command).
- Anthropic bundling.
- Marketing site sitemap on authsome-web.
Adds the codecov badge to the badge row alongside the existing Tests
badge so the coverage signal sits next to the build signal. Adds a
Star History chart between Contributing and License using the
star-history.com embed, with light/dark variants via <picture>.
The codecov badge depends on the codecov integration being wired up
for agentrhq/authsome; if it isn't yet, the badge will render as
"unknown" until the integration is enabled.
The README had grown stale relative to the project's current state. This
brings it up to par with comparable open-source credential tools
(Doppler, Infisical) and agent infra READMEs (Ollama, Continue).
Tier 1 (correctness):
- Fix Tests + codecov badge URLs from manojbajaj95 to agentrhq.
- Drop broken link to docs/specs/authsome-v1.md (removed upstream).
- Replace 3 em-dashes with periods per house style.
- Repoint Docs section links to hosted authsome.agentr.dev/docs instead
of local MDX paths (better reading experience on GitHub).
Tier 2 (close gaps every comparable project has):
- Add Install section before Quick Start with pip and uvx commands.
- Add Community section linking Discord and Issues.
- Add Security section pointing at the responsible disclosure policy.
Critical for a credential tool; was previously absent.
- Add Contributing section linking to CONTRIBUTING.md.
Tier 3 (polish and differentiation):
- Add light/dark wordmark logo at top (reuses the SVG mark shipped to
the docs site, sized for README hero).
- Add header link bar (Docs / Website / Discord / Issues).
- Surface "44 bundled providers" callout near the top.
- Add Agent Integrations section listing Claude Code, Codex, Cursor,
OpenCode, LangChain, LlamaIndex, OpenAI Agents SDK, Anthropic SDK.
- Add Discord badge to the badge row.
- Replace the ASCII art block with the logo image. The ASCII was a
placeholder before a real brand mark existed.
Two characters were off in the slant FIGlet render of 'authsome':
- Line 1 was missing a leading space
- Line 2 had '_/' instead of '__/' breaking the 't' descender
Add host_url field to atlassian, discord, gitlab, hubspot, microsoft,
notion, and slack provider JSON configs. Fix docs to reflect current
flow names (api_key, device_code), add --show-secret to README example,
and remove --profile flag references that are no longer supported.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add local HTTP proxy runner for on-the-fly credential injection in child processes
- Add RC publish workflow triggered on successful tests on develop branch
- Add OAuth scope management and prompting during client login
* refactor: unify API key flow logic, update authentication tests to use bridge, and add CI workflow badge.
* refactor: expand test coverage and add Codecov badge to README
* refactor: remove unused TokenExpiredError alias from client tests
* chore: remove ty type checking from CI workflow
* feat: add type checking, improve token refresh error handling, and enable HTTP server port reuse in tests
* refactor: add whitespace to conftest for improved readability
* fix: ensure HTTPServer cleanup via finally blocks and improved test fixture teardown
* style: reorder imports in conftest.py to follow PEP 8 standards
* refactor: clean up whitespace and formatting in test server cleanup fixture
* refactor: enable address reuse directly in PKCE flow handlers and remove global test configuration
* feat: make callback port configurable in PKCE and DCR PKCE flows and update tests to use dynamic ports
* test: dynamic callback port assignment in PKCE and DCR PKCE flow tests
* docs(spec): overhaul authsome-v1 spec with security model, provider states, and naming fixes
- Rename all .authlib/.authlib_home references to .authsome/AUTHSOME_HOME
- Add master.key to filesystem layout with 0600 permission requirement
- Add Provider State Model section (available → configured → connected)
- Introduce Sensitive Input Pipeline section (env var → browser bridge → getpass)
- Remove --client-secret as CLI argument; client_secret collected via pipeline only
- Add client.client_id_env/client_secret_env fields to OAuth provider schema
- Remove refresh_token from export maps; access token only exported
- Rewrite authsome login: error on re-login, --reset flag, new input model
- Update authsome list to show full provider catalog across all states
- Fix authsome run: access token injection only, error if provider not connected
- Add executable name authsome throughout CLI examples
- Fix store key namespace: provider definitions are filesystem files, not store keys
- Update all E2E examples to reflect new flows
- Renumber all sections cleanly (35 sections total)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs(readme): Updated readme to be more clear and prettier
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: remove global --json flag support and update documentation to reflect CLI changes
* docs: simplify and condense README content with a focused CLI reference
Reframes authsome as local OAuth2/API key management for agents — not a
secret manager. Adds PyPI/license/downloads badges, clearer tagline,
problem statement, why-authsome comparison table, full provider list, and
a technical deep dive section.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rishabhraj36