The control plane for connected tools

Connected tools. Your traffic.

Give every signed-in user a connected toolset without putting Authlane between your runtime and provider APIs. Load the catalog, start Authlane's hosted connect flow, then execute directly from your trusted SaaS runtime.

Start building Read the docs

One API
User-scoped tools
No provider proxy

How requests move

Connect once

Tenant backendYour backend loads services from Authlane.
Your productYour product renders its integrations UI.
Hosted connectUser user_123 connects through an origin-bound OAuth session.

Authlane coordinates consent and stores the resulting credential state encrypted.

Use everywhere

Your runtimeYour runtime reads user tools and status from Authlane.
Provider APIYour runtime calls the provider directly.

Authlane is not in this path

Developer journey

First success, not first configuration

Load the catalog on your server, compose the UI in your product, connect an external user, and hand that user's executable tools to your framework.

01
Load services
SDK or REST API from your backend.
02
Offer them in your UI
Your layout and product experience.
03
Connect by user ID
A short-lived, origin-bound session.
04
Give tools to your agent
Vercel AI, OpenAI Agents, Mastra, or MCP.

Server-only catalog

import { Authlane } from '@authlane/sdk';

const authlane = new Authlane({
  apiKey: process.env.AUTHLANE_API_KEY!,
});

const { data: services, error } = await authlane.services.list();
if (error) {
  console.error('Could not load services', error.message);
  return [];
}
return services;

curl https://app.authlane.io/api/v1/catalog/services \
  -H "Authorization: Bearer $AUTHLANE_API_KEY"

Keep the tenant API key in trusted backend code. The browser receives safe service records, never the key.

Your integrations UI

<ServicePicker
  services={services}
  onConnect={(serviceId) => connectUser(serviceId)}
/>

Authlane supplies the catalog. Your product owns layout, copy, filtering, and behavior.

Origin-bound hosted connect

const { data: session, error } = await authlane.connectSessions.create({
  externalUserId: 'user_123',
  allowedServices: [],
  allowedOrigin: 'https://app.example.com',
  expiresInSeconds: 600,
});
if (error) {
  return <ConnectError message={error.message} />;
}

return <AuthlaneConnect connectUrl={session.url} onEvent={refreshConnections} />;

The short-lived session binds your signed-in external user, service allowlist, and exact parent origin. An empty list allows every tenant-enabled service; pass explicit IDs when this screen should offer only a subset.

User-scoped framework output

import { vercelAI } from '@authlane/ai/vercel';

const user = authlane.user('user_123');
const { data: tools, error } = await user.tools.list({ adapter: vercelAI() });
if (error) {
  return Response.json({ message: error.message }, { status: 502 });
}
return streamText({ model, messages, tools });

import { openAIAgents } from '@authlane/ai/openai';

const user = authlane.user('user_123');
const { data: tools, error } = await user.tools.list({ adapter: openAIAgents() });
if (error) {
  return Response.json({ message: error.message }, { status: 502 });
}
const agent = new Agent({ name: 'Support', tools });

import { mastraAI } from '@authlane/ai/mastra';

const user = authlane.user('user_123');
const { data: tools, error } = await user.tools.list({ adapter: mastraAI() });
if (error) {
  throw new Error(error.message);
}
const agent = new Agent({ name: 'Support', tools });

import { mcpServer } from '@authlane/ai/mcp';

const user = authlane.user('user_123');
const { data: server, error } = await user.tools.list({ adapter: mcpServer() });
if (error) {
  console.error('Could not create MCP server', error.message);
  return;
}
await server.connect(transport);

Each executor runs in your trusted SaaS runtime and requests an access-only lease only when the selected tool executes. The MCP adapter creates a local, in-process server there; Authlane does not expose or host an MCP server.

Product boundary

Keep the control plane thin

Authlane holds connection state and tool definitions. It does not sit between your application and provider APIs.

Control-plane reads: Your server reads enabled services, live connection states, and immutable tool definition versions from Authlane. Listing them does not issue a credential lease.
Provider traffic: At tool execution, your local adapter requests a scoped access lease and calls the provider directly. Authlane never receives the provider request or response body.

Security boundaries

Secrets stay behind explicit trust boundaries

Browser-safe connection setup and server-only execution use separate, narrowly scoped credentials.

Server-only API key: Tenant API keys stay in trusted server-side code and never enter the browser.
Bound connect session: OAuth starts from a short-lived session scoped to one tenant, user, service allowlist, and exact parent origin.
Encrypted refresh material: Refresh and ID tokens remain encrypted inside the Authlane control plane.
Just-in-time access lease: A local executor requests short-lived, access-only material only when a selected tool runs, never while definitions or status are listed.
Direct provider route: Provider requests and responses stay between your trusted SaaS runtime and the provider API.
Audit trail: Credential access is recorded for tenant-scoped operational review.

Built-in catalog

The integrations shipped in the repository

Service availability, authentication methods, and tool coverage can differ. This is the factual built-in catalog, grouped by use case.

Developer tools

GitHubgithub
Linearlinear
Jirajira

Communication

Slackslack
Discorddiscord
Gmailgmail
Microsoft Mailmicrosoft-mail

Productivity

Notionnotion
Google Drivegoogle-drive
Google Calendargoogle-calendar
Microsoft Drive (SharePoint)microsoft-sharepoint
Microsoft Calendarmicrosoft-calendar

CRM

HubSpothubspot
Salesforcesalesforce
Pipedrivepipedrive
Attioattio

Other

Stripestripe
Airtableairtable

One deployment boundary

One application, PostgreSQL, and Redis

Cloud and self-hosted installations use the same Authlane application boundary. The runtime serves the product and control-plane routes, PostgreSQL stores tenant state, and Redis supports hot reads, queues, and rate limits.

01Authlane application
02PostgreSQL
03Redis

Build on your boundary

Connect once. Keep execution yours.

Start with the service catalog, then carry one external user identity through hosted connect and into locally executing tools.

Start building