Authsome

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL

https://heyclau.de/entry/tools/authsome

Source URLs

https://authsome.ai/docs, https://github.com/agentrhq/authsome, https://authsome.ai

Brand

Authsome

Brand domain

authsome.ai

Brand asset source

brandfetch

Safety notes

Installs and runs a local daemon plus a local HTTPS proxy (`authsome run`) on loopback (`127.0.0.1`). Both processes are long-running and intercept outbound HTTPS to matched provider hostnames., The proxy injects credentials into outbound requests by adding `Authorization` headers; it does not modify request bodies. Agents running behind it will perform live, authenticated API calls against the provider (send emails, post to Slack, charge Stripe, write to GitHub, etc.) using the user's real credentials., The daemon performs background OAuth2 token refresh by contacting each provider's token endpoint. Refresh failures or network outages can leave a provider in a stale state until `authsome login <provider>` is re-run., Network access is required for OAuth flows, background token refresh, and the agent's provider API calls. The proxy itself only listens on loopback; outbound provider traffic leaves the host normally., Installable via `uv tool install authsome` or `pip install authsome`. Standard package-install risk profile applies; verify the package source on PyPI (`authsome`) and the upstream repository (`agentrhq/authsome`) before installing.

Privacy notes

Credentials are stored locally in an encrypted vault under `~/.authsome`. They are not transmitted to any Agentr- or Authsome-hosted service., When the agent calls a provider, the local proxy injects the matching OAuth2 token or API key into the outbound request and sends it to that provider (e.g. github.com, openai.com). Credentials reach the provider you authenticated with, by design, since the provider call requires them., OAuth2 access tokens are refreshed in the background by the local daemon, which contacts the provider's token endpoint. Refresh tokens remain in the local vault and are not sent anywhere other than the provider's token endpoint., First-time login uses browser PKCE, device code, or a local browser bridge for API key entry. The browser flow sends user credentials to the provider's own authorization endpoint, not to Agentr., Telemetry is opt-in and respects `DO_NOT_TRACK=1`, `POSTHOG_DISABLED=1`, and `AUTHSOME_ANALYTICS=0`.

Author

Agentr

Submitted by

zriyansh

Claim status

unclaimed

Last verified

2026-05-25

• Credentials are stored locally in an encrypted vault under `~/.authsome`. They are not transmitted to any Agentr- or Authsome-hosted service.
• When the agent calls a provider, the local proxy injects the matching OAuth2 token or API key into the outbound request and sends it to that provider (e.g. github.com, openai.com). Credentials reach the provider you authenticated with, by design, since the provider call requires them.
• OAuth2 access tokens are refreshed in the background by the local daemon, which contacts the provider's token endpoint. Refresh tokens remain in the local vault and are not sent anywhere other than the provider's token endpoint.
• First-time login uses browser PKCE, device code, or a local browser bridge for API key entry. The browser flow sends user credentials to the provider's own authorization endpoint, not to Agentr.
• Telemetry is opt-in and respects `DO_NOT_TRACK=1`, `POSTHOG_DISABLED=1`, and `AUTHSOME_ANALYTICS=0`.

• Python 3.13+ runtime on the host.
• Install authsome locally via `uv tool install authsome` (recommended), `pip install authsome`, or `uvx authsome@latest`. Package source is PyPI under the name `authsome`.
• A user account with each external provider you intend to connect (GitHub, Google, OpenAI, Linear, Slack, Notion, Resend, Stripe, etc.). For OAuth2 providers, the first-time login opens a browser; some providers also support device code flow for headless setup.
• Network access on the host for the initial OAuth2 / API-key registration and for live API calls the agent makes through the proxy.
• A Claude Code (or other agentskills.io-compatible agent) session that can reach `127.0.0.1` for the loopback proxy. The agent must trust the local proxy endpoint authsome configures.
• Acceptance that authsome installs a long-running local daemon and a local HTTPS proxy on loopback. Both must be running while the agent makes provider API calls.

Show that Authsome is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

[![Listed on HeyClaude](https://heyclau.de/badge/tools/authsome.svg)](https://heyclau.de/entry/tools/authsome)

Authsome side by side with 2 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field	Authsome Local credential broker for AI agents. Log in once via OAuth2 or API key, encrypted local vault stores credentials, and a local proxy injects them at request time so agents never see raw secret values. Open dossier	AnythingLLM Local-first AI application for private chat, document RAG, workspace agents, MCP-compatible tools, model routing, memories, scheduled tasks, multimodal workflows, multi-user Docker deployments, and self-hosted agent automation. Open dossier	Cherry Studio Cross-platform AI desktop client with multiple LLM providers, local model support, 300+ assistants, document and image handling, WebDAV backup, MCP server support, mini programs, and enterprise deployment options. Open dossier
Next steps	Open dossierCopy installAPI JSONOpen LLMOpen sourceNewsletterClaim listing	Open dossierCopy installAPI JSONOpen LLMOpen sourceNewsletterClaim listing	Open dossierCopy installAPI JSONOpen LLMOpen sourceNewsletterClaim listing
Trust	Review first	Review first	Review first
Review status	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed
Package trust	Package not verified	Package not verified	Package not verified
Source provenance	Source-backed	Source-backed	Source-backed
SubmitterDiffers	zriyansh	—	—
Install risk	Review first	Review first	Review first
Notes	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓
Brand	Authsome	Docker	Cherry Studio
Category	tools	tools	tools
Source	source-backed	source-backed	source-backed
Author	Agentr	Mintplex Labs	CherryHQ
Added	2026-05-25	2026-06-18	2026-06-18
Platforms	CLI	CLI	CLI
Source repo	—	—	—
Safety notes	✓Installs and runs a local daemon plus a local HTTPS proxy (`authsome run`) on loopback (`127.0.0.1`). Both processes are long-running and intercept outbound HTTPS to matched provider hostnames. The proxy injects credentials into outbound requests by adding `Authorization` headers; it does not modify request bodies. Agents running behind it will perform live, authenticated API calls against the provider (send emails, post to Slack, charge Stripe, write to GitHub, etc.) using the user's real credentials. The daemon performs background OAuth2 token refresh by contacting each provider's token endpoint. Refresh failures or network outages can leave a provider in a stale state until `authsome login <provider>` is re-run. Network access is required for OAuth flows, background token refresh, and the agent's provider API calls. The proxy itself only listens on loopback; outbound provider traffic leaves the host normally. Installable via `uv tool install authsome` or `pip install authsome`. Standard package-install risk profile applies; verify the package source on PyPI (`authsome`) and the upstream repository (`agentrhq/authsome`) before installing.	✓AnythingLLM can run agents, scheduled tasks, MCP-compatible tools, browser-like workspace actions, developer APIs, and external model calls; scope tools and credentials before enabling them for users. The upstream Docker guide includes examples that add the SYS_ADMIN capability to the container. Review whether that capability is acceptable for the host before copying production run commands. Multi-user Docker deployments need normal production controls: authentication, TLS, network isolation, secret management, persistent-volume ownership, backups, and upgrade planning. Agent tools, custom agents, model routing, memories, and scheduled tasks can change behavior over time; use least privilege, logging, review gates, and rollback plans for write-capable workflows. Localhost services such as Ollama, Chroma, LocalAI, or LM Studio may need Docker host routing adjustments; avoid exposing local provider ports wider than intended.	✓Cherry Studio is a desktop AI client that can connect to multiple cloud providers, local model servers, MCP servers, mini programs, document parsers, backup services, and enterprise backends; review each integration before adding sensitive data. MCP server support can expose model-callable tools. Only connect servers you trust, and scope file, shell, browser, SaaS, and write-capable tools carefully. Document and image processing can read local files and generate derived text, charts, summaries, or code blocks that may persist in app state or backups. WebDAV backup and sync can move local conversation or document state to a remote storage provider; verify endpoint, encryption, retention, and restore behavior. The README describes Enterprise Edition and private deployment options; confirm licensing, access control, data backup, and team management requirements before rollout.
Privacy notes	✓Credentials are stored locally in an encrypted vault under `~/.authsome`. They are not transmitted to any Agentr- or Authsome-hosted service. When the agent calls a provider, the local proxy injects the matching OAuth2 token or API key into the outbound request and sends it to that provider (e.g. github.com, openai.com). Credentials reach the provider you authenticated with, by design, since the provider call requires them. OAuth2 access tokens are refreshed in the background by the local daemon, which contacts the provider's token endpoint. Refresh tokens remain in the local vault and are not sent anywhere other than the provider's token endpoint. First-time login uses browser PKCE, device code, or a local browser bridge for API key entry. The browser flow sends user credentials to the provider's own authorization endpoint, not to Agentr. Telemetry is opt-in and respects `DO_NOT_TRACK=1`, `POSTHOG_DISABLED=1`, and `AUTHSOME_ANALYTICS=0`.	✓Uploaded documents, parsed chunks, embeddings, workspace memories, prompts, chat history, agent state, scheduled task inputs, MCP payloads, provider responses, logs, and API calls may contain sensitive data. The README documents anonymous telemetry and an opt-out through DISABLE_TELEMETRY=true or the in-app privacy setting; review this before using regulated or confidential data. Even with telemetry disabled, outbound calls may still go to configured LLMs, embedding models, vector databases, external tools, cdn.anythingllm.com, GitHub, or GitHubusercontent depending on the deployment. Keep provider keys, JWT secrets, workspace invite links, storage paths, private documents, and generated citations out of public prompts, screenshots, issues, and examples.	✓Prompts, model responses, local documents, images, Office files, PDFs, assistant settings, topic history, MCP tool arguments, WebDAV backups, provider keys, and logs may contain sensitive data. Cloud model providers, AI web services, local model servers, MCP servers, WebDAV endpoints, mini programs, and enterprise services may receive data depending on configuration. Keep provider API keys, WebDAV credentials, enterprise endpoints, local model URLs, MCP config, document contents, and exported chats out of public prompts, screenshots, issues, and examples. For team use, define which models, assistants, MCP servers, backups, knowledge bases, and enterprise admin controls are approved.
Prerequisites	Python 3.13+ runtime on the host. Install authsome locally via `uv tool install authsome` (recommended), `pip install authsome`, or `uvx authsome@latest`. Package source is PyPI under the name `authsome`. A user account with each external provider you intend to connect (GitHub, Google, OpenAI, Linear, Slack, Notion, Resend, Stripe, etc.). For OAuth2 providers, the first-time login opens a browser; some providers also support device code flow for headless setup. Network access on the host for the initial OAuth2 / API-key registration and for live API calls the agent makes through the proxy.	Docker for the documented self-hosted path, or the desktop application for a local workstation install. At least the upstream minimum host resources, with disk sized for documents, embeddings, vector storage, models, logs, and backups. A local or remote LLM provider, embedding provider, and optional speech or image models for the workflows the workspace will run. A storage, backup, retention, and access-control plan before ingesting private documents or opening a multi-user Docker instance.	Windows, macOS, or Linux desktop environment. Model provider credentials for cloud services, or local Ollama / LM Studio setup for local model use. A review of AGPL-3.0 community edition terms and any Enterprise Edition terms before organization-wide use. WebDAV credentials only if file backup and sync are needed.
Install	uv tool install authsome Copy install	docker pull mintplexlabs/anythingllm Copy install	Download the current Cherry Studio desktop release for your operating system from GitHub Releases. Copy install
Config	—	—	—
Citations	Source repositorygithub.com 2026-07-13T15:19:32-07:00 Documentationauthsome.ai Websiteauthsome.ai Submitted by zriyansh2026-05-25 Source methodology →	Source repositorygithub.com 2026-07-13T15:19:32-07:00 Documentationdocs.anythingllm.com Source methodology →	Source repositorygithub.com 2026-07-13T15:19:32-07:00 Documentationdocs.cherry-ai.com Source methodology →
Claim	Unclaimed	Unclaimed	Unclaimed

Source-backed guides for putting this to work.