Introduction

Authpipe is the credential management layer between your app and every third-party API. It handles OAuth authorization flows, encrypted token storage, silent refresh, API key management, and webhook signing — so you never write credential management code again.

Authpipe vs. Clerk

Clerk (user auth)	Authpipe (API connections)
Authenticates your users	Manages credentials for third-party APIs
Session tokens	Always-valid access tokens
<SignIn />	createAuthSession("slack")
useUser()	getCredential("google-drive")

Clerk answers “who is this user?” Authpipe answers “give me a working Slack token for this tenant.”

Three tiers of credentials

Authpipe manages credentials at three levels:

Tier	Entity	Example
App identity	Provider Config	Your Slack OAuth app’s client_id / client_secret
Installation	Installation	A Slack bot installed in a customer’s workspace
User	Connection	A user’s personal OAuth grant to your Slack app

All secrets are encrypted with AES-256-GCM using per-workspace isolation keys.

Quick start

Node

import { Authpipe } from "@authpipe/node";

const authpipe = new Authpipe({
  apiKey: process.env.AUTHPIPE_API_KEY,
});

// Get a valid credential — always fresh, always ready
const { credential } = await authpipe.getCredential({
  provider: "google-drive",
  tenantId: "org_acme",
  userId: "user_123",
});

Go

import "github.com/authpipe-dev/authpipe-go"

client := authpipe.NewClient(os.Getenv("AUTHPIPE_API_KEY"))

result, err := client.GetCredential(ctx, &authpipe.GetCredentialParams{
  Provider: "google-drive",
  TenantID: "org_acme",
  UserID:   "user_123",
})

Python

from authpipe import Authpipe

client = Authpipe(api_key=os.environ["AUTHPIPE_API_KEY"])

result = client.get_credential(
    provider="google-drive",
    tenant_id="org_acme",
    user_id="user_123",
)

How it works

1. Configure a provider — Register your OAuth app’s client_id and client_secret with Authpipe.
2. User connects — Create an auth session, redirect the user, Authpipe handles the OAuth callback and stores encrypted tokens.
3. Get credentials — Call getCredential from your backend. Authpipe returns a valid access token, refreshing it automatically if needed.
4. Automatic refresh — A background scheduler refreshes tokens before they expire. If refresh fails, the connection is marked needs_reauth and an event is emitted.

Next steps

• Quickstart — Set up your first integration end-to-end.
• Core Concepts — Understand workspaces, providers, connections, and the attachment model.
• SDK Reference — Full API surface for Node, Go, and Python.