Credential broker

Agents get capability, not credentials — the secret is never in your app.

Every item on screen is one Checkfu Connection. The app embeds the same Connect Center as the Checkfu dashboard while its backend uses only the public SDK. OAuth and pasted credentials go directly to the selected adapter’s short-lived trusted handoff; they never pass through the embedding app.

Source: examples/credential-broker in the repository. The index at examples/README.md compares all eight side by side.

Golden journeys

• Choose a qualified offering and complete its trusted setup handoff
• Pair and inspect a customer-hosted Integration Bridge
• Assign a time-boxed capability to an Agent
• Plan explicit tool and agent access
• Inspect account activity and revoke under an optimistic version fence

Platform surfaces exercised

Integration Gateway offerings and ConnectionSessions, Connections, PermissionAssignments, Audit, Principals, and Integration Bridges.

From the source

One public SDK controller drives every hosted and customer-local connection lane:

path=examples/credential-broker/server/src/broker-runtime.ts

	const connectCenterFor = (principalId: string) =>
		createConnectCenterController(client, principalId)

This block is quoted from the file, not retyped: the docs check fails if it drifts.

Honest gaps

Recorded in examples/credential-broker/README.md. In particular, this customer-shaped app does not substitute for the exact deployment’s live OAuth, hostile-tenant, planted-secret, restore, capacity, or alert evidence.