as

Auth infrastructure for coding agents — user pools, secrets vault, token management. As easy as git.

git for your code. as for your auth.

Your agent can scaffold a whole app in an afternoon — then stalls the moment it needs auth. It hardcodes secrets into .env files it later commits, rolls its own JWT handling, and leaves you wiring up Cognito by hand. AuthShore is the auth layer your agent runs itself: one install, and it provisions user pools, stores secrets encrypted, and mints, validates and refreshes tokens — from the terminal, with no console to click through.

Works with: Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client

See It In Action

Real terminal sessions against the live API — click a GIF for the full video.

Zero to auth in 60s	Secrets vault	Tokens & pools

More demos: authshore.ai/#demo

Install

npm install -g authshore

The npm package is authshore; the command is as.

Quick Start

# 1. Create a project — free plan, API key active immediately, no card
as signup my-project --email you@example.com --local

# 2. Create a user pool
as pool create main

# 3. Store a secret (encrypted at rest, versioned)
as secret set DATABASE_URL "postgres://user:pass@host:5432/db"

# 4. Sign up a user in your pool
as pool auth signup main --email user@example.com --password SecurePass123!

# Full reference
as help

User Pools — Cognito without the console

Every project gets isolated user pools your agent manages from the terminal: create pools, add users, run full signup/signin flows that return real JWT pairs.

as pool create main                      # create a pool
as pool list                             # list pools
as pool users <id>                       # list users in a pool
as pool user add <id> --email E --password P
as pool auth signup <id> --email E --password P   # returns access + refresh tokens
as pool auth signin <id> --email E --password P

Secrets Vault — stop pasting keys into .env

Encrypted, versioned key-value storage scoped to your project. Your agent stores third-party keys once and reads them at deploy time — nothing sensitive left sitting in the repo.

as secret set STRIPE_KEY "sk_..." --env production
as secret get STRIPE_KEY                 # decrypted read
as secret list
as secret versions STRIPE_KEY            # full version history
as secret delete STRIPE_KEY

Tokens — mint, validate, refresh, revoke

The JWT plumbing agents usually hand-roll, done right once.

as token validate <jwt>                  # verify signature + expiry, show claims
as token refresh <refresh-token>         # rotate the pair
as token revoke <token>                  # kill a compromised token

MCP Server

Prefer tools over a CLI? as ships an MCP server. Point Claude Code (or any MCP client) at it and your agent gets 18 native tools: pools, users, secrets, tokens, project status.

claude mcp add authshore --env AUTHSHORE_API_KEY=as_y

... [View full README on GitHub](https://github.com/jyswee/authshore#readme)