noauth

Centralized OAuth token service on Modal with encrypted storage and automatic refresh.

SDK install (GitHub)

Use this when you only want the client library (no Modal server deps). This install does not pull Modal.

uv pip install "git+https://github.com/thehumanworks/noauth.git"

Minimal usage:

from noauth.sdk import NoAuthClient

# Credentials can be provided via:
# 1. Explicit parameters (shown below)
# 2. Environment variables (NOAUTH_CLIENT_ID, NOAUTH_CLIENT_SECRET)
# 3. ~/.modal.toml file

client = NoAuthClient(
    base_url="https://<your-app>.modal.run",
    token_id="wk-...",
    token_secret="ws-...",
)
print(client.health().message)

# Store an OAuth credential
client.store_credential(
    "codex",
    "oauth",
    config={"client_id": "...", "token_url": "..."},
    tokens={"access_token": "...", "refresh_token": "..."},
)

# Get credentials
cred = client.get_credential("codex", "oauth")
print(cred.tokens.get("access_token"))

# List credentials
creds = client.list_credentials()
print([c.name for c in creds])

# Refresh OAuth tokens
client.refresh_credential("codex")

## CLI usage

```bash
# Health check
noauth health

# Get OAuth credential tokens
noauth get codex --kind oauth

# Get bearer credential value
noauth get api-key --kind bearer

# Store OAuth tokens (from JSON file)
noauth store codex ./tokens.json

# Store OAuth config + optional tokens
noauth store-credential codex --kind oauth --config ./config.json --tokens ./tokens.json

# Store bearer token
noauth store-credential api-key --kind bearer --value "secret"

# Refresh OAuth credential
noauth refresh codex

# List credentials
noauth list
noauth list --kind oauth

# Delete credential
noauth delete codex --kind oauth --force

## Doppler secrets

noauth can use Doppler as the credential store. Set `DOPPLER_TOKEN`, `DOPPLER_PROJECT`, and `DOPPLER_CONFIG` for the Modal app. When enabled, OAuth credentials are stored as JSON in Doppler under `CODEX_AUTH_JSON` and `GEMINI_AUTH_JSON`.

## Server install (Modal app)

Use this when you want to deploy the service:

```bash
uv pip install "git+https://github.com/thehumanworks/noauth.git#egg=noauth[server]"

Deploy:

uv run modal deploy -m noauth.app

Notes:

• All endpoints require Modal Proxy Auth. Use a Proxy Auth token (wk-.../ws-...).
• API/CLI tokens (ak-/as-) are not valid for proxy auth.