Skip to main content
Use this guide when Hookfish should run inside an existing Node.js service. For a separate broker service, the quickstart generates the broker host for you.

Install dependencies

Configure Hookfish

Create hookfish.config.ts at your project root.

Create the server

Mount Hookfish at /api. Keep your user-facing application routes under a separate prefix.
requireUser authenticates the application’s session and enforces its permissions. scopedBrokerTokenFor selects a server-side Hookfish credential for the authorized organization. Neither concern belongs in Hookfish itself. The custom fetch function lets the typed Hono client call the embedded Hookfish handler without making a network request. Use the broker’s HTTPS URL instead when Hookfish runs as a separate service.

Call your application from the browser

Share ApplicationApi with your frontend and create a Hono RPC client for your application routes.
Use this same server-side pattern for authorization starts, disconnects, provider-token retrieval, and vault access. Return provider tokens or decrypted secrets only to trusted server consumers. Continue with application authentication for the complete security boundary.