Dynamic providers

Dynamic providers are database-backed instances of fixed provider templates. Use them when tenants need separate OAuth applications, remote MCP endpoints, or provider credentials beneath different resource paths.

Enable provider management

export default defineHookfishConfig({
  db,
  providers,
  providerManagement: true,
})

This mounts root-authenticated CRUD operations below /api/admin/providers. Provider paths use the same resource-scope checks as connection IDs and vault paths.

Credential modes

Mode	Behavior
`inherit`	Reuse the complete credential pair from the fixed template
`custom`	Store a supplied client ID and optional client secret
`register`	Ask the template to register a client, then store the result

The API resolves register into an inherited or custom stored credential mode. Client secrets are encrypted and never returned.

Create and manage a provider

curl --request PUT http://127.0.0.1:8787/api/admin/providers/acme/github \
  --header "Authorization: Bearer $HOOKFISH_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
    "template": "github",
    "label": "Acme GitHub",
    "credentials": {
      "mode": "custom",
      "client_id": "<client-id>",
      "client_secret": "<client-secret>"
    }
  }'

Use PATCH /api/admin/providers/{provider_path} to update fields or set enabled: false. A disabled provider blocks new authorizations while existing connections can still refresh or revoke their credentials. Deletion returns 409 while a connection references the provider. Disconnect those accounts before deleting the configuration.

Tenant isolation

With organization routing enabled, manage tenant providers below:

/api/organization/{organization}/admin/providers/{provider_path}

The organization is stored separately and the provider path must remain under the same organization resource namespace. Use an organization-scoped broker token instead of the root key for tenant operations.

Creating an MCP provider can perform outbound discovery and client registration. Give provider-management credentials only to principals you trust to configure integrations within their resource subtree.

Get started

Store secrets

Integrate

Deploy

Secure and scale

Operate

Dynamic providers

Enable provider management

Credential modes

Create and manage a provider

Tenant isolation

​Enable provider management

​Credential modes

​Create and manage a provider

​Tenant isolation

Enable provider management

Credential modes

Create and manage a provider

Tenant isolation