Authenticated access to any API — without touching a developer portal.
SF Tether handles the token vault, OAuth flows, automatic refresh, scope enforcement, and provider catalog — so your agents get scoped, audited access the first time, every time.
[ CORE ENGINE — RUNTIME ]
POST /api/broker/token is the hot path of the entire product. Pass an end-user reference and a provider slug; receive a short-lived, scoped access token in under 50ms (p50) when the credential is fresh — no developer-portal sessions, no manual refresh logic.
Resolves end-user → connection → credential in a single batched CTE
Checks connection status and fires single-flight refresh within a 30s expiry window
Enforces scope policy — excess-scope requests return 400 with the exact missing scopes
Rate-limited: 100 issuances/min per key+user; 10k/min per API key (KV-backed)
Every issuance logged to an append-only audit table with latency, scopes, and outcome
[ HOW IT WORKS — STEP BY STEP ]
The provider setup wizard walks you through Google Cloud Console, Slack, GitHub, and 25+ others. Paste your callback URL, enter client_id and client_secret — Tether encrypts and stores them via AES-256-GCM. Done in under 5 minutes per provider.
Embed the Connect button or redirect to the OAuth start endpoint. The consent screen shows your brand, the provider logo, and every scope in plain English with risk badges. The signed PKCE state JWT keeps the flow replay-proof — code_verifier never leaves the server.
Every agent request hits POST /api/broker/token with an SDK key, end-user ref, and provider slug. Tether resolves, checks, refreshes if needed, and returns a short-lived provider token — no agent ever holds a long-lived credential.
Scope policies evaluate on every token request — even if you tighten a rule after the connection was made. The audit log records scopes requested vs issued, latency, agent session, and outcome. Revoke any connection instantly; a panic-button bulk-revoke is one confirmation away.
[ OAUTH ENGINE ]
Top providers use typed, PKCE-correct client primitives. The long tail falls back to a generic OAuth2 adapter that reads directly from the provider catalog. Every quirk — Google's offline_access, Slack's user vs bot tokens, GitHub Apps, Microsoft's tenant URLs — is handled per-provider.
Code verifier stored server-side in tether_oauth_pending_state — never round-trips through the browser. State JWT carries only a jti; replay protection is enforced at the DB layer.
When Google or Slack rotate refresh tokens, Tether atomically updates the stored credential in the same transaction that writes the new access token. Stale tokens cannot strand a connection.
Provider catalog pre-populated with OAuth endpoints, scope catalogs, icons, and docs URLs for Google, Microsoft 365, Slack, GitHub, Notion, Linear, Salesforce, Jira, HubSpot, Shopify, and more.
See the full matrix of who is connected to what, with status badges, scope grants, last-used timestamps, and error counts. Virtualized for orgs with tens of thousands of rows. Bulk-revoke or force-refresh from a single click.
Filter by status, provider, age, or error count
Click-through to per-connection timeline and live token preview
Export filtered slice as CSV or JSON for audits
[ GOVERNANCE & SECURITY ]
Scope policies evaluate on every token issuance — not just at connection time. Tighten a rule after an agent has been running for a week; the next token request respects it immediately.
Per-org, per-provider rules: allowed scopes, denied scopes, require-human-approval flag, and a default TTL. Called by both the OAuth start endpoint and the broker — no policy bypass at any layer.
Access tokens and refresh tokens are encrypted at the Drizzle column layer via AES-256-GCM before they touch Postgres. A raw SELECT returns ciphertext. Key rotation is a single admin operation.
FORCE ROW LEVEL SECURITY on every tenant-scoped table. The request-path DB client runs without BYPASSRLS. Cross-tenant reads return zero rows — at the database, not in application code.
Three tabs — provider allowlist, per-provider scope editor with risk-level badges, and a rate-limit editor for requests/min and daily token caps per key or connection. Every change is written to the audit log.
Toggle providers on/off for your org
Allow, deny, or gate any scope behind human approval
Set per-connection and per-key daily token issuance caps
Panic-button: revoke every connection in the org with one confirmed action
When an agent needs a scope the connection doesn't hold, Tether creates a scope upgrade request, notifies the end-user by email with a magic re-auth link, and returns a requires_consent response with a consentUrl. The agent retries after the user approves. Least-privilege without dead ends.
Scope upgrade request queued — no silent failure
End-user receives a signed magic re-auth link by email
Agent retries after consent — flow resumes automatically
[ AUDIT & OBSERVABILITY ]
Two append-only tables — tether_connection_events and tether_broker_issuance_log — capture every OAuth event and every token issuance with scopes, latency, agent session ID, IP hash, and outcome. UPDATE and DELETE are revoked at the DB role layer. Auditors get raw evidence; the dashboard gives everyone a filterable timeline.
Unified log explorer: filter by event type, connection, end-user, provider, IP, time range
Click any row to expand full JSON metadata
Export filtered slices as CSV or JSON for SOC2 evidence
Admin credential reveals are individually audited — every token peek is logged
Full org data export (connections, scope grants, audit trail) for GDPR data-portability
[ PROVIDER CATALOG ]
OAuth endpoints, scope catalogs, risk levels, provider logos, and docs URLs are seeded for 25+ common providers. A daily Temporal cron syncs against the Nango provider YAML — new providers arrive as auto-generated PRs for human review, never silent overrides.
Browse the end-users whose tokens you vault. See connection count, last activity, and external user ID. Click through to revoke all connections for a specific user — the GDPR offboarding flow is one confirmation dialog.
Sortable, filterable data table with virtualized scroll
Per-user detail: all connections across all providers
Single-action GDPR offboarding with AlertDialog confirmation
Browse all providers with logos, category filters, scope catalogs with risk levels, OAuth endpoints, and docs URLs. One click to add a provider to your org's allowlist.
Guided walkthrough for registering your OAuth app with Google, Microsoft, Slack, GitHub, Notion, and Linear. Copy the exact callback URL, paste credentials, done. A 30-minute dev-portal hunt becomes a 5-minute paste.
[ DEVELOPER SURFACE ]
Node, Python, and Go snippets — five lines max to get a live token. Your actual SDK key is pre-filled. A 'Test it' button runs the snippet server-side and shows the real provider response.
Full REST surface auto-generated under /api/rest/v1/tether/* with an OpenAPI spec. Connections, end-users, providers, policies, and logs are all scriptable from your CRM or CI pipeline.
Tether operations registered as MCP tools — listProviders, getToken, startOAuth, revoke. Any MCP-aware framework can wire Tether in natively with zero glue code.
Issue keys with tether:broker (token issuance only), tether:read-connections (read-only), or tether:admin (full access). Optionally scope a key to a subset of providers and a per-day issuance cap.
Three permission profiles: broker, read-connections, admin
Per-key provider scope restrictions
Per-day issuance cap configurable per key
Suite-link auth for SF Core-to-Tether calls (no extra SDK key needed)
Pick a connection, choose an endpoint, edit request params in a JSON editor, and hit Send. The playground brokers a real token and proxies the call — response status, headers, and body shown in a syntax-highlighted panel. Closes the gap between 'I have a token' and 'I made my first API call'.
Real provider calls — not mocked
Last 20 calls saved per developer
Full response: status, headers, body
[ RELIABILITY & SCALE ]
Single-flight refresh Concurrent broker requests for the same connection serialize through a Postgres advisory lock — exactly one provider HTTP call fires, regardless of how many agents request it simultaneously.
Hash-bucket refresh cron The refresh Temporal cron partitions credentials into 8 hash buckets, runs every 5 minutes, and enforces per-tenant fairness so one busy org cannot monopolise a refresh tick.
Fail-closed rate limiter If the KV store backing the rate limiter is unreachable, the limiter returns 503 — not a silent pass. A per-container fallback caps requests even under KV failure.
Partitioned audit tables tether_broker_issuance_log and tether_connection_events are range-partitioned by month. Retention drops old partitions in constant time — no DELETE scans on millions of rows.
Issuance log outbox The broker writes to a lightweight outbox table instead of directly to the issuance log. A drain worker batches 1,000 rows every 30 seconds — hot-path latency doesn't depend on log write throughput.
Provider health badges A Temporal cron checks provider reachability every 10 minutes and surfaces operational/degraded/down badges in the dashboard and as X-Provider-Status response headers.
Background token refresh Credentials expiring in the next 15 minutes are refreshed proactively. A circuit breaker per provider prevents a single outage from cascading across the refresh fleet.
Webhook HMAC delivery connection.* and broker.* events are HMAC-signed and delivered to customer endpoints. SSRF protection resolves and validates every delivery host before the request leaves.
Encrypted at the column layer Drizzle custom column type auto-encrypts on write, auto-decrypts on read. No application code path can accidentally store a plaintext token — the schema enforces the boundary.
[ FREQUENTLY ASKED ]
Join the waitlist. Ship the next generation of software with every API connection least-privilege and fully audited from day one.
Questions? Email us at sf-core-org-support-sf-tether@saas-factory.ai
