Skip to main content
Hookfish helps your application manage secrets for its users. Those secrets can be API keys, OAuth tokens, MCP access tokens, or other credentials your app needs to keep safe. You manage how users sign in and what they are allowed to do. Hookfish keeps track of their secrets and access tokens, encrypts them at rest, and gives your backend a consistent way to use them.

Quickstart

Create a Hookfish project and connect your first account.

Add Hookfish to your app

Add Hookfish to an existing server and use your current application setup.

Connect an MCP server

Connect users to a remote MCP server and keep their access tokens safe.

Try the MCP inspector

Explore tools, resources, and prompts from a local interface.

What Hookfish does for you

  • Stores API keys and other secrets for your users
  • Runs OAuth and MCP authorization flows
  • Encrypts access tokens, refresh tokens, and stored secrets
  • Refreshes OAuth tokens when they expire
  • Keeps each connected account under a stable connection ID
  • Lets your backend give different services access to different users or resource paths

What stays in your application

  • Signing users in
  • Deciding which users can connect, view, or disconnect accounts
  • Mapping each user or organization to its Hookfish resource path
  • Choosing where Hookfish runs and where its encrypted data is stored
Hookfish works with the authentication system you already use, including Auth.js, Clerk, Auth0, Supabase Auth, or your own session system.

Secrets stay on the server

Your backend can retrieve a user’s API key or current provider token when it needs to call another service. Your browser calls your application’s normal, authenticated API. After checking the user, your server calls Hookfish with a scoped broker credential.
You can use Hono RPC on both sides of that boundary: one typed client for the browser to call your application, and another in server code to call Hookfish. Only return connection metadata and other values the browser needs.
Never put HOOKFISH_API_KEY, a scoped broker token, a provider access token, or a decrypted vault value in browser code.

Where to start