Quickstart
Create a Hookfish project and connect your first account.
Add Hookfish to your app
Add Hookfish to an existing server and use your current application setup.
Connect an MCP server
Connect users to a remote MCP server and keep their access tokens safe.
Try the MCP inspector
Explore tools, resources, and prompts from a local interface.
What Hookfish does for you
- Stores API keys and other secrets for your users
- Runs OAuth and MCP authorization flows
- Encrypts access tokens, refresh tokens, and stored secrets
- Refreshes OAuth tokens when they expire
- Keeps each connected account under a stable connection ID
- Lets your backend give different services access to different users or resource paths
What stays in your application
- Signing users in
- Deciding which users can connect, view, or disconnect accounts
- Mapping each user or organization to its Hookfish resource path
- Choosing where Hookfish runs and where its encrypted data is stored
Secrets stay on the server
Your backend can retrieve a user’s API key or current provider token when it needs to call another service. Your browser calls your application’s normal, authenticated API. After checking the user, your server calls Hookfish with a scoped broker credential.Where to start
- Start with the quickstart to create a Hookfish project and make your first connection.
- Follow a framework guide to add Hookfish to an existing application.
- Read How Hookfish works before designing callbacks, application auth, or multi-tenant routing.
- Review the production security checklist before accepting real provider credentials.