Introduction

Authlane gives a SaaS organization one place to configure services, connect its external users, encrypt credentials, read effective status, and load AI tool definitions.

Choose the control-plane boundary

Browsers use a short-lived hosted connect session. SaaS backends use scoped tenant API keys for catalog, status, definitions, connect sessions, and audited access-only credential leases. AI framework adapters and provider handlers execute inside the SaaS runtime.

Browser -> Authlane: hosted connection and OAuth
SaaS -> Authlane: catalog, status, definitions, lease
SaaS -> Provider: tool input and provider request
Provider -> SaaS: provider response

Provider traffic never passes through Authlane. Authlane has no tool-execution endpoint, hosted MCP server, or reusable cross-user credential.

Build the first working path

1. Follow the Quickstart.
2. Understand how Authlane works and the core concepts.
3. Implement service discovery, hosted connect, and user-scoped tools.
4. Choose an SDK or framework.
5. Apply production hardening.

Operate one runtime

The production Hono application serves the dashboard, hosted connect UI, OAuth callbacks, versioned control-plane API, refresh jobs, and webhook outbox. PostgreSQL stores tenant policy and encrypted records; Redis supports hot reads, distributed rate limiting, and queues.

Self-hosters should continue with self-hosting, then complete the security operations launch gate.