# Vouch

> Vouch is an open-source credential broker that replaces long-lived secrets (AWS keys, SSH keys, GitHub PATs, registry tokens) with short-lived credentials after FIDO2 hardware verification. One YubiKey tap, up to 8 hours of access, full audit trail.

Vouch replaces static secrets in the development workflow. It federates identity through OIDC, so every credential is tied to a verified hardware key and expires automatically — no key rotation scripts, offboarding checklists, or secrets in config files are required.

Every HTML page on vouch.sh is also served as raw Markdown at the same URL (e.g. `/docs/getting-started/index.md`). Token counts below are approximate (chars ÷ 4).

- [Source code](https://github.com/vouch-sh/vouch)
- [Agent capability manifest](https://vouch.sh/agents.md)
- [Full documentation for LLMs](https://vouch.sh/llms-full.txt)

## Documentation

- [Applications (OIDC)](https://vouch.sh/docs/applications/): Integrate Vouch as an OIDC provider in your web, SPA, or native app for hardware-verified authentication. (~4351 tok)
  - [Rails (OmniAuth)](https://vouch.sh/docs/applications/rails/): Integrate Vouch OIDC authentication into a Ruby on Rails application using OmniAuth. (~239 tok)
  - [Django (django-allauth)](https://vouch.sh/docs/applications/django/): Integrate Vouch OIDC authentication into a Django application using django-allauth. (~218 tok)
  - [Express.js (openid-client)](https://vouch.sh/docs/applications/express/): Integrate Vouch OIDC authentication into an Express.js application using openid-client. (~224 tok)
  - [Next.js (NextAuth.js)](https://vouch.sh/docs/applications/nextjs/): Integrate Vouch OIDC authentication into a Next.js application using NextAuth.js. (~239 tok)
  - [Laravel (Socialite)](https://vouch.sh/docs/applications/laravel/): Integrate Vouch OIDC authentication into a Laravel application using Socialite. (~249 tok)
  - [Flask (Authlib)](https://vouch.sh/docs/applications/flask/): Integrate Vouch OIDC authentication into a Flask application using Authlib. (~203 tok)
  - [FastAPI (Authlib)](https://vouch.sh/docs/applications/fastapi/): Integrate Vouch OIDC authentication into a FastAPI application using Authlib. (~204 tok)
  - [Spring Boot (Spring Security)](https://vouch.sh/docs/applications/spring-boot/): Integrate Vouch OIDC authentication into a Spring Boot application using Spring Security OAuth2. (~246 tok)
  - [Axum (openidconnect-rs)](https://vouch.sh/docs/applications/axum/): Integrate Vouch OIDC authentication into a Rust Axum application using openidconnect-rs. (~227 tok)
  - [Go (go-oidc)](https://vouch.sh/docs/applications/go/): Integrate Vouch OIDC authentication into a Go application using go-oidc and oauth2. (~208 tok)
  - [ASP.NET Core (OpenID Connect)](https://vouch.sh/docs/applications/aspnet-core/): Integrate Vouch OIDC authentication into an ASP.NET Core application using the built-in OpenID Connect middleware. (~215 tok)
  - [React (react-oidc-context)](https://vouch.sh/docs/applications/react/): Integrate Vouch OIDC authentication into a React single-page application using react-oidc-context. (~221 tok)
  - [Vue (oidc-client-ts)](https://vouch.sh/docs/applications/vue/): Integrate Vouch OIDC authentication into a Vue single-page application using oidc-client-ts. (~240 tok)
  - [SvelteKit (oidc-client-ts)](https://vouch.sh/docs/applications/sveltekit/): Integrate Vouch OIDC authentication into a SvelteKit single-page application using oidc-client-ts. (~216 tok)
  - [Angular (angular-auth-oidc-client)](https://vouch.sh/docs/applications/angular/): Integrate Vouch OIDC authentication into an Angular single-page application using angular-auth-oidc-client. (~237 tok)
  - [Vanilla JavaScript](https://vouch.sh/docs/applications/vanilla-js/): Integrate Vouch OIDC authentication into a plain JavaScript application using oidc-client-ts. (~233 tok)
  - [BFF Pattern (Express)](https://vouch.sh/docs/applications/bff-express/): Secure a single-page application with hardware-backed authentication using the Backend-for-Frontend pattern with Express and openid-client. (~248 tok)
  - [Device Authorization (CLI)](https://vouch.sh/docs/applications/device-authorization/): Integrate Vouch authentication into native desktop applications and CLI tools using the Device Authorization Grant. (~443 tok)
  - [MCP Remote Server (TypeScript)](https://vouch.sh/docs/applications/mcp-server-ts/): Build an MCP remote server with Vouch OIDC bearer token authentication using the TypeScript SDK. (~234 tok)
  - [MCP Remote Server (Python)](https://vouch.sh/docs/applications/mcp-server-py/): Build an MCP remote server with Vouch OIDC bearer token authentication using the Python FastMCP SDK. (~212 tok)
  - [MCP Credential Broker](https://vouch.sh/docs/applications/mcp-credential-broker/): Build an MCP server that brokers AWS, GitHub, and SSH credentials through Vouch identity verification. (~215 tok)
  - [A2A Agent (Python)](https://vouch.sh/docs/applications/a2a-agent/): Build an Agent-to-Agent (A2A) protocol agent secured with Vouch OIDC bearer token authentication. (~170 tok)
  - [Credential Brokering Agents](https://vouch.sh/docs/applications/credential-brokering-agents/): Build CLI agents that authenticate with Vouch device flow and broker AWS, GitHub, and SSH credentials. (~256 tok)
- [AWS](https://vouch.sh/docs/aws/): Stop distributing long-lived AWS access keys. Use OIDC federation to get temporary STS credentials backed by a YubiKey. (~6855 tok)
- [CLI Reference](https://vouch.sh/docs/cli-reference/): Complete command reference for the Vouch CLI — login, credentials, setup, and configuration. (~6908 tok)
- [SSH Certificates](https://vouch.sh/docs/ssh/): Eliminate authorized_keys management. Vouch issues SSH certificates that expire in 8 hours — no key distribution, no offboarding checklist. (~2491 tok)
- [Team Rollout](https://vouch.sh/docs/rollout/): Give a growing team access to AWS, EKS, CodeCommit, CodeArtifact, and more through a single OIDC provider and IAM role. (~2239 tok)
- [Admin Dashboard](https://vouch.sh/docs/admin/): Manage organization members, view audit logs, configure SCIM tokens, and enforce device posture policies from the Vouch admin dashboard. (~1266 tok)
- [Architecture](https://vouch.sh/docs/architecture/): System components, protocols, and trust boundaries — how the Vouch CLI, agent, and server work together. (~5573 tok)
- [AWS Multi-Account](https://vouch.sh/docs/aws-multi-account/): Deploy Vouch OIDC federation across multiple AWS accounts with Organizations, StackSets, and SCPs. (~7181 tok)
- [GitHub](https://vouch.sh/docs/github/): Replace GitHub PATs with short-lived tokens generated from your hardware-backed Vouch session. (~1510 tok)
- [Startups](https://vouch.sh/docs/startups/): Connect Google Workspace to AWS with OIDC federation — no IAM users, access keys, or IAM Identity Center required. (~1933 tok)
- [Amazon EKS](https://vouch.sh/docs/eks/): Access EKS clusters using OIDC-federated IAM credentials instead of long-lived kubeconfig tokens. (~3206 tok)
- [Docker Registries](https://vouch.sh/docs/docker/): Stop running docker login and storing plaintext credentials. Vouch generates registry tokens on demand for ECR and GHCR. (~2012 tok)
- [SCIM Provisioning](https://vouch.sh/docs/scim/): Sync users and groups from your identity provider to Vouch automatically using SCIM 2.0. (~3848 tok)
- [Security](https://vouch.sh/docs/security/): How Vouch protects credentials at every layer — data flow, threat model, credential lifecycle, and supply chain integrity. (~4827 tok)
- [AWS CodeCommit](https://vouch.sh/docs/codecommit/): Clone and push to AWS CodeCommit repositories using short-lived credentials instead of HTTPS Git credentials or SSH keys. (~1871 tok)
- [Cargo](https://vouch.sh/docs/cargo/): Use Vouch as a Cargo credential provider for private registries — no tokens in .cargo/config.toml. (~1667 tok)
- [Device Posture](https://vouch.sh/docs/device-posture/): Enforce security requirements on developer devices before issuing credentials — disk encryption, firewalls, screen lock, endpoint protection, and history-aware policies for rate limiting and step-up. (~7965 tok)
- [Threat Model](https://vouch.sh/docs/threat-model/): STRIDE-based threat analysis — threat actors, trust boundaries, assumptions, threats, and mitigations for the Vouch credential broker. (~11395 tok)
- [Availability](https://vouch.sh/docs/availability/): What happens when the Vouch server is unreachable — offline behavior, credential expiry, and blast radius. (~1509 tok)
- [AWS CodeArtifact](https://vouch.sh/docs/codeartifact/): Pull and publish packages from AWS CodeArtifact using hardware-backed credentials — no token files, no refresh scripts. (~3161 tok)
- [Kubernetes](https://vouch.sh/docs/kubernetes/): Access any Kubernetes cluster using OIDC tokens from Vouch — no cloud-specific plugins required. (~2001 tok)
- [SAML](https://vouch.sh/docs/saml/): Use SAML 2.0 identity providers with Vouch — Microsoft Entra ID, Google Workspace, and more. (~1098 tok)
- [AWS Systems Manager](https://vouch.sh/docs/ssm/): Use AWS Systems Manager Session Manager with Vouch credentials to reach EC2 instances without opening SSH ports. (~1630 tok)
- [Email Domains](https://vouch.sh/docs/domains/): Verify additional email domains for your organization and claim a dedicated OIDC issuer subdomain with its own signing keys for AWS federation. (~1990 tok)
- [Migration](https://vouch.sh/docs/migration/): Migrate from static credentials to Vouch — phased rollout, integration-by-integration checklist, and rollback plan. (~1604 tok)
- [SPIFFE](https://vouch.sh/docs/spiffe/): Connect hardware-verified developer identity to SPIFFE workload identity — federate Vouch OIDC tokens with SPIRE for zero-trust infrastructure. (~2239 tok)
- [Audit Export](https://vouch.sh/docs/audit-export/): Pull audit events into your SIEM with the audit events API — cursor-based polling, NDJSON streaming, and OCSF 1.9.0 projection. (~1919 tok)
- [Claude & OpenAI APIs](https://vouch.sh/docs/ai-api-keys/): Use Vouch as the OIDC issuer for Anthropic and OpenAI Workload Identity Federation, so local development and one-off scripts don't need a long-lived sk-ant- or sk- key. (~3048 tok)
- [Databases](https://vouch.sh/docs/databases/): Replace static database passwords with 15-minute IAM auth tokens generated from hardware-backed credentials. (~1867 tok)
- [FAQ](https://vouch.sh/docs/faq/): Common questions about Vouch — supported hardware, session behavior, platform support, and cost. (~2987 tok)
- [Amazon Bedrock](https://vouch.sh/docs/bedrock/): Connect to Amazon Bedrock foundation models using short-lived credentials with full audit trails. (~764 tok)
- [Infrastructure as Code](https://vouch.sh/docs/iac/): Run CDK, Terraform, SAM, and other IaC tools using short-lived AWS credentials from Vouch. (~533 tok)
- [CI/CD](https://vouch.sh/docs/cicd/): Require a YubiKey tap before production deployments — hardware-verified identity embedded in every CI/CD credential. (~1158 tok)
- [Getting Started](https://vouch.sh/docs/getting-started/): Install the Vouch CLI, enroll your YubiKey, and replace static secrets with hardware-backed credentials. (~2550 tok)

## Product

- [Compare](https://vouch.sh/compare/): How Vouch compares to Teleport, HashiCorp Vault, AWS IAM Identity Center, and 1Password

## Optional

- [About](https://vouch.sh/about/): Learn about Vouch and Smoke Turner, LLC
- [Privacy Policy](https://vouch.sh/privacy/): Privacy policy for vouch.sh
- [Terms of Service](https://vouch.sh/terms/): Terms of service for vouch.sh