L/ Layups Connect

OSS preview Apache-2.0

Credentials at the edge.

Layups Connect is a small, self-hosted credential broker for agentic software—compatible with the Vercel Connect runtime contract and designed to run on Cloudflare.

Explore the source ↗Deploy your own ↓
// Inside an Activity, job, or agent tool
const { token } = await getToken({
  connector: 'google',
  subject: {
    type: 'user',
    id: accountEmail,
  },
});

// Use it, then let it go.
Cloudflare Worker
SQLite Durable Object
OIDC workload auth
Provider-neutral API
The idea

Your workflows should know what they can do—not where the secrets live.

01 / SEPARATE

Broker credentials, not behavior

Connect owns OAuth state, refresh tokens, API keys, and short-lived token delivery. Your runtime owns provider capabilities such as email.send.

02 / PORTABLE

Keep the runtime contract

Use familiar Connect request and response shapes with a configurable origin. Move off a hosted broker without rewriting every caller.

03 / OWNED

Deploy inside your boundary

Run the broker, encrypted grant store, and policy checks in your Cloudflare account. No application filesystem and no shared credential SaaS required.

Architecture

A narrow control plane between trusted workloads and providers.

01 / ConsumerAgent · Activity
Job · APIRequests a connector token for a subject.
02 / BrokerLayups ConnectAuthenticates, authorizes, refreshes, audits, and returns the least it can.
03 / ProviderGoogle account
Mail first, Workspace nextThe consumer calls the provider directly.
Cloudflare Durable Object · encrypted SQLite grant custody · one-time OAuth state
Cloudflare native

One Worker. One stateful object. Your account.

The production entry point and the marketing site ship together. Durable Object SQLite provides the coordination boundary for grants and OAuth state, while Wrangler manages the deployment.

  • No Docker volume
  • No always-on server
  • No separate database service
  • Secret bindings stay out of Git
terminal — self-hosting outline
# 1. Clone and verify
git clone git@github.com:layups-ai/layups-connect.git
cd layups-connect
mise install
pnpm install --frozen-lockfile
pnpm check

# 2. Add deployment secrets
pnpm --filter @layups/connect-worker exec wrangler secret put \
  CONNECT_ENCRYPTION_KEYRING_JSON
# Repeat for GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.

# 3. Review wrangler.json, then ship
pnpm deploy
Project scope

Small surface. Explicit boundaries. Honest compatibility.

What is here now

  • Generic Google accounts with an initial mail.send capability grant
  • Connect-shaped token, authorization, metadata, and revocation routes
  • OIDC workload identity, policy scopes, rate limits, and secret-free audit events
  • Cloudflare Worker and SQLite Durable Object production path

Where contributors can help

  • Additional provider definitions and capability adapters
  • Connector installation and authorization webhooks
  • Operational tooling for key rotation and grant administration
  • More compatibility fixtures and deployment profiles

Own the credentials. Keep the workflows portable.

Follow on GitHub ↗