Skip to main content
A credential broker lets users connect external accounts and grant bounded capabilities without handing raw provider secrets to your application or Agent. The Checkfu model is one trust chain: Vault and Credential custody, Connection identity, PermissionAssignment, ActionPolicy, ActionApproval, revocation, and audit. Start with the quickstart. In one Workspace, create or update an Agent, select an Environment, and start a Session. Session admission freezes the resolved AgentVersion and Environment authority. Every later interaction is read from and appended to the Session event log.

​
What this example demonstrates

  1. A trusted setup handoff writes authorization material into a Vault as a Credential. The value is write-only and never appears in example code.
  2. A Connection represents the governed provider account or capability link. It is not the Credential itself.
  3. PermissionAssignment makes an actor or Agent eligible to use the Connection.
  4. ActionPolicy resolves an eligible action to allow, require_approval, or deny.
  5. ActionApproval records a human decision about one frozen action. Approval never grants missing permission and never preserves authority after revocation.
  6. The trusted effect edge rechecks the live Connection, permission, policy, approval, schema, egress, and revocation state before attaching Credential material to the outbound provider request.
  7. Audit records the decision and structural outcome without returning the secret.
The model and harness may choose a tool and propose arguments. Checkfu keeps the custodied provider Credential at its outbound rendering edge instead of supplying it to the model or harness. The OAuth/bearer custody adapter checks exact transmitted-credential echoes in supported JSON, SSE, and text responses before release. This does not cover arbitrary encoded or transformed echoes or other secrets: provider results are not automatically secret-free. Session events can record the proposed action, policy disposition, approval state, and redacted settlement; keep secret material out of those events.

​
Revocation and uncertain effects

Revocation is checked before every new provider effect. An earlier ActionApproval does not override a later revocation. When a provider outcome is uncertain, record the effect as indeterminate and reconcile it before retrying. A credential rotation or reconnect changes future authority; it does not rewrite the history of already accepted Session events. Standard retention may keep permitted nonsecret event content and audit records under policy. Qualified ZDR paths omit execution content from durable custody; permitted structural records and linkable issuer or recovery references may remain. ZDR support depends on the selected deployment, runtime, and provider; see retention and ZDR. Usage, not traces, drives Budget enforcement. A provider adapter, catalog row, or local fixture is not evidence of hosted support; consult capability status.

​
Pinned source boundary

The optional source uses the public Connect Center controller from its backend. The controller coordinates supported Connection operations, but its presence does not prove that every listed provider is qualified in a particular deployment.
path=examples/credential-broker/server/src/broker-runtime.ts

​
What this example omits

This page does not include a Credential value, promise universal OAuth support, promote customer-hosted topology, or replace deployment-specific hostile-tenant, planted-secret, restore, capacity, and alert verification.