> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookfish.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Dynamic providers

> Create tenant-specific OAuth configurations without redeploying Hookfish.

Dynamic providers are database-backed instances of fixed provider templates.
Use them when tenants need separate OAuth applications, remote MCP endpoints,
or provider credentials beneath different resource paths.

## Enable provider management

```ts theme={null}
export default defineHookfishConfig({
  db,
  providers,
  providerManagement: true,
})
```

This mounts root-authenticated CRUD operations below `/api/admin/providers`.
Provider paths use the same resource-scope checks as connection IDs and vault
paths.

## Credential modes

| Mode       | Behavior                                                     |
| ---------- | ------------------------------------------------------------ |
| `inherit`  | Reuse the complete credential pair from the fixed template   |
| `custom`   | Store a supplied client ID and optional client secret        |
| `register` | Ask the template to register a client, then store the result |

The API resolves `register` into an inherited or custom stored credential mode.
Client secrets are encrypted and never returned.

## Create and manage a provider

```bash theme={null}
curl --request PUT http://127.0.0.1:8787/api/admin/providers/acme/github \
  --header "Authorization: Bearer $HOOKFISH_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
    "template": "github",
    "label": "Acme GitHub",
    "credentials": {
      "mode": "custom",
      "client_id": "<client-id>",
      "client_secret": "<client-secret>"
    }
  }'
```

Use `PATCH /api/admin/providers/{provider_path}` to update fields or set
`enabled: false`. A disabled provider blocks new authorizations while existing
connections can still refresh or revoke their credentials.

Deletion returns `409` while a connection references the provider. Disconnect
those accounts before deleting the configuration.

## Tenant isolation

With organization routing enabled, manage tenant providers below:

```text theme={null}
/api/organization/{organization}/admin/providers/{provider_path}
```

The organization is stored separately and the provider path must remain under
the same organization resource namespace. Use an organization-scoped broker
token instead of the root key for tenant operations.

<Warning>
  Creating an MCP provider can perform outbound discovery and client
  registration. Give provider-management credentials only to principals you
  trust to configure integrations within their resource subtree.
</Warning>