> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookfish.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Hookfish

> Manage API keys, OAuth tokens, MCP access tokens, and other secrets for your application's users.

Hookfish helps your application manage secrets for its users. Those secrets can
be API keys, OAuth tokens, MCP access tokens, or other credentials your app
needs to keep safe.

You manage how users sign in and what they are allowed to do. Hookfish keeps
track of their secrets and access tokens, encrypts them at rest, and gives your
backend a consistent way to use them.

<Columns cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Create a Hookfish project and connect your first account.
  </Card>

  <Card title="Add Hookfish to your app" icon="code" href="/frameworks/hono">
    Add Hookfish to an existing server and use your current application setup.
  </Card>

  <Card title="Connect an MCP server" icon="plug" href="/providers/remote-mcp">
    Connect users to a remote MCP server and keep their access tokens safe.
  </Card>

  <Card title="Try the MCP inspector" icon="microscope" href="/operations/inspector">
    Explore tools, resources, and prompts from a local interface.
  </Card>
</Columns>

## What Hookfish does for you

* Stores API keys and other secrets for your users
* Runs OAuth and MCP authorization flows
* Encrypts access tokens, refresh tokens, and stored secrets
* Refreshes OAuth tokens when they expire
* Keeps each connected account under a stable connection ID
* Lets your backend give different services access to different users or
  resource paths

## What stays in your application

* Signing users in
* Deciding which users can connect, view, or disconnect accounts
* Mapping each user or organization to its Hookfish resource path
* Choosing where Hookfish runs and where its encrypted data is stored

Hookfish works with the authentication system you already use, including
Auth.js, Clerk, Auth0, Supabase Auth, or your own session system.

## Secrets stay on the server

Your backend can retrieve a user's API key or current provider token when it
needs to call another service. Your browser calls your application's normal,
authenticated API. After checking the user, your server calls Hookfish with a
scoped broker credential.

```text theme={null}
Browser → your authenticated API → Hookfish → provider
```

You can use Hono RPC on both sides of that boundary: one typed client for the
browser to call your application, and another in server code to call Hookfish.
Only return connection metadata and other values the browser needs.

<Warning>
  Never put `HOOKFISH_API_KEY`, a scoped broker token, a provider access token, or
  a decrypted vault value in browser code.
</Warning>

## Where to start

* Start with the [quickstart](/quickstart) to create a Hookfish project and make
  your first connection.
* Follow a [framework guide](/frameworks/hono) to add Hookfish to an existing
  application.
* Read [How Hookfish works](/concepts/how-it-works) before designing callbacks,
  application auth, or multi-tenant routing.
* Review the [production security checklist](/reference/security) before
  accepting real provider credentials.