# Vouch

> Vouch is an open-source credential broker that replaces long-lived secrets (AWS keys, SSH keys, GitHub PATs, registry tokens) with short-lived credentials after FIDO2 hardware verification. One YubiKey tap, up to 8 hours of access, full audit trail.

Vouch eliminates static secrets across your development workflow. It federates identity through OIDC, so every credential is tied to a verified hardware key and expires automatically. No more key rotation scripts, no more offboarding checklists, no more secrets in config files.

Every HTML page on vouch.sh is also served as raw Markdown at the same URL (e.g. `/docs/getting-started/index.md`). Token counts below are approximate (chars ÷ 4).

- [Source code](https://github.com/vouch-sh/vouch)
- [Agent capability manifest](https://vouch.sh/agents.md)
- [Full documentation for LLMs](https://vouch.sh/llms-full.txt)

## Documentation

- [Applications (OIDC)](https://vouch.sh/docs/applications/): Integrate Vouch as an OIDC provider in your web, SPA, or native app for hardware-verified authentication. (~4366 tok)
  - [Rails (OmniAuth)](https://vouch.sh/docs/applications/rails/): Integrate Vouch OIDC authentication into a Ruby on Rails application using OmniAuth. (~239 tok)
  - [Django (django-allauth)](https://vouch.sh/docs/applications/django/): Integrate Vouch OIDC authentication into a Django application using django-allauth. (~218 tok)
  - [Express.js (openid-client)](https://vouch.sh/docs/applications/express/): Integrate Vouch OIDC authentication into an Express.js application using openid-client. (~224 tok)
  - [Next.js (NextAuth.js)](https://vouch.sh/docs/applications/nextjs/): Integrate Vouch OIDC authentication into a Next.js application using NextAuth.js. (~239 tok)
  - [Laravel (Socialite)](https://vouch.sh/docs/applications/laravel/): Integrate Vouch OIDC authentication into a Laravel application using Socialite. (~249 tok)
  - [Flask (Authlib)](https://vouch.sh/docs/applications/flask/): Integrate Vouch OIDC authentication into a Flask application using Authlib. (~203 tok)
  - [FastAPI (Authlib)](https://vouch.sh/docs/applications/fastapi/): Integrate Vouch OIDC authentication into a FastAPI application using Authlib. (~204 tok)
  - [Spring Boot (Spring Security)](https://vouch.sh/docs/applications/spring-boot/): Integrate Vouch OIDC authentication into a Spring Boot application using Spring Security OAuth2. (~246 tok)
  - [Axum (openidconnect-rs)](https://vouch.sh/docs/applications/axum/): Integrate Vouch OIDC authentication into a Rust Axum application using openidconnect-rs. (~227 tok)
  - [Go (go-oidc)](https://vouch.sh/docs/applications/go/): Integrate Vouch OIDC authentication into a Go application using go-oidc and oauth2. (~208 tok)
  - [ASP.NET Core (OpenID Connect)](https://vouch.sh/docs/applications/aspnet-core/): Integrate Vouch OIDC authentication into an ASP.NET Core application using the built-in OpenID Connect middleware. (~215 tok)
  - [React (react-oidc-context)](https://vouch.sh/docs/applications/react/): Integrate Vouch OIDC authentication into a React single-page application using react-oidc-context. (~221 tok)
  - [Vue (oidc-client-ts)](https://vouch.sh/docs/applications/vue/): Integrate Vouch OIDC authentication into a Vue single-page application using oidc-client-ts. (~240 tok)
  - [SvelteKit (oidc-client-ts)](https://vouch.sh/docs/applications/sveltekit/): Integrate Vouch OIDC authentication into a SvelteKit single-page application using oidc-client-ts. (~216 tok)
  - [Angular (angular-auth-oidc-client)](https://vouch.sh/docs/applications/angular/): Integrate Vouch OIDC authentication into an Angular single-page application using angular-auth-oidc-client. (~237 tok)
  - [Vanilla JavaScript](https://vouch.sh/docs/applications/vanilla-js/): Integrate Vouch OIDC authentication into a plain JavaScript application using oidc-client-ts. (~233 tok)
  - [BFF Pattern (Express)](https://vouch.sh/docs/applications/bff-express/): Secure a single-page application with hardware-backed authentication using the Backend-for-Frontend pattern with Express and openid-client. (~248 tok)
  - [Device Authorization (CLI)](https://vouch.sh/docs/applications/device-authorization/): Integrate Vouch authentication into native desktop applications and CLI tools using the Device Authorization Grant. (~443 tok)
  - [MCP Remote Server (TypeScript)](https://vouch.sh/docs/applications/mcp-server-ts/): Build an MCP remote server with Vouch OIDC bearer token authentication using the TypeScript SDK. (~234 tok)
  - [MCP Remote Server (Python)](https://vouch.sh/docs/applications/mcp-server-py/): Build an MCP remote server with Vouch OIDC bearer token authentication using the Python FastMCP SDK. (~212 tok)
  - [MCP Credential Broker](https://vouch.sh/docs/applications/mcp-credential-broker/): Build an MCP server that brokers AWS, GitHub, and SSH credentials through Vouch identity verification. (~215 tok)
  - [A2A Agent (Python)](https://vouch.sh/docs/applications/a2a-agent/): Build an Agent-to-Agent (A2A) protocol agent secured with Vouch OIDC bearer token authentication. (~170 tok)
  - [Credential Brokering Agents](https://vouch.sh/docs/applications/credential-brokering-agents/): Build CLI agents that authenticate with Vouch device flow and broker AWS, GitHub, and SSH credentials. (~255 tok)
- [AWS](https://vouch.sh/docs/aws/): Stop distributing long-lived AWS access keys. Use OIDC federation to get temporary STS credentials backed by a YubiKey. (~5965 tok)
- [CLI Reference](https://vouch.sh/docs/cli-reference/): Complete command reference for the Vouch CLI — login, credentials, setup, and configuration. (~6391 tok)
- [SSH Certificates](https://vouch.sh/docs/ssh/): Eliminate authorized_keys management. Vouch issues SSH certificates that expire in 8 hours — no key distribution, no offboarding checklist. (~2480 tok)
- [Team Rollout](https://vouch.sh/docs/rollout/): The playbook for giving a growing team access to AWS, EKS, CodeCommit, CodeArtifact, and more — without becoming the bottleneck. (~2247 tok)
- [Admin Dashboard](https://vouch.sh/docs/admin/): Manage organization members, view audit logs, configure SCIM tokens, and enforce device posture policies from the Vouch admin dashboard. (~941 tok)
- [Architecture](https://vouch.sh/docs/architecture/): System components, protocols, and trust boundaries — how the Vouch CLI, agent, and server work together. (~5364 tok)
- [AWS Multi-Account](https://vouch.sh/docs/aws-multi-account/): Deploy Vouch OIDC federation across multiple AWS accounts with Organizations, StackSets, and SCPs. (~7056 tok)
- [GitHub](https://vouch.sh/docs/github/): Replace GitHub PATs with short-lived tokens generated from your hardware-backed Vouch session. (~1506 tok)
- [Startups](https://vouch.sh/docs/startups/): Skip IAM users, access keys, and IAM Identity Center. Go from Google Workspace to AWS in minutes with OIDC federation. (~1957 tok)
- [Amazon EKS](https://vouch.sh/docs/eks/): Access EKS clusters using OIDC-federated IAM credentials instead of long-lived kubeconfig tokens. (~3202 tok)
- [Docker Registries](https://vouch.sh/docs/docker/): Stop running docker login and storing plaintext credentials. Vouch generates registry tokens on demand for ECR and GHCR. (~2008 tok)
- [SCIM Provisioning](https://vouch.sh/docs/scim/): Sync users and groups from your identity provider to Vouch automatically using SCIM 2.0. (~3780 tok)
- [Security](https://vouch.sh/docs/security/): How Vouch protects credentials at every layer — data flow, threat model, credential lifecycle, and supply chain integrity. (~4344 tok)
- [AWS CodeCommit](https://vouch.sh/docs/codecommit/): Clone and push to AWS CodeCommit repositories using short-lived credentials instead of HTTPS Git credentials or SSH keys. (~1757 tok)
- [Cargo](https://vouch.sh/docs/cargo/): Use Vouch as a Cargo credential provider for private registries — no tokens in .cargo/config.toml. (~1667 tok)
- [Device Posture](https://vouch.sh/docs/device-posture/): Enforce security requirements on developer devices before issuing credentials — disk encryption, firewalls, screen lock, endpoint protection, and more. (~4369 tok)
- [Threat Model](https://vouch.sh/docs/threat-model/): STRIDE-based threat analysis — threat actors, trust boundaries, assumptions, threats, and mitigations for the Vouch credential broker. (~7497 tok)
- [Availability](https://vouch.sh/docs/availability/): What happens when the Vouch server is unreachable — offline behavior, credential expiry, and blast radius. (~1522 tok)
- [AWS CodeArtifact](https://vouch.sh/docs/codeartifact/): Pull and publish packages from AWS CodeArtifact using hardware-backed credentials — no token files, no refresh scripts. (~2873 tok)
- [Kubernetes](https://vouch.sh/docs/kubernetes/): Access any Kubernetes cluster using OIDC tokens from Vouch — no cloud-specific plugins required. (~1997 tok)
- [SAML](https://vouch.sh/docs/saml/): Use SAML 2.0 identity providers with Vouch — Microsoft Entra ID, Google Workspace, and more. (~1104 tok)
- [AWS Systems Manager](https://vouch.sh/docs/ssm/): Use AWS Systems Manager Session Manager with Vouch credentials to reach EC2 instances without opening SSH ports. (~1617 tok)
- [Migration](https://vouch.sh/docs/migration/): Migrate from static credentials to Vouch — phased rollout, integration-by-integration checklist, and rollback plan. (~1603 tok)
- [SPIFFE](https://vouch.sh/docs/spiffe/): Connect hardware-verified developer identity to SPIFFE workload identity — federate Vouch OIDC tokens with SPIRE for zero-trust infrastructure. (~2245 tok)
- [Claude & OpenAI APIs](https://vouch.sh/docs/ai-api-keys/): Use Vouch as the OIDC issuer for Anthropic and OpenAI Workload Identity Federation, so local development and one-off scripts don't need a long-lived sk-ant- or sk- key. (~3053 tok)
- [Databases](https://vouch.sh/docs/databases/): Replace static database passwords with 15-minute IAM auth tokens generated from hardware-backed credentials. (~1870 tok)
- [FAQ](https://vouch.sh/docs/faq/): Common questions about Vouch — supported hardware, session behavior, platform support, and cost. (~2804 tok)
- [Amazon Bedrock](https://vouch.sh/docs/bedrock/): Connect to Amazon Bedrock foundation models using short-lived credentials with full audit trails. (~765 tok)
- [Infrastructure as Code](https://vouch.sh/docs/iac/): Run CDK, Terraform, SAM, and other IaC tools using short-lived AWS credentials from Vouch. (~530 tok)
- [CI/CD](https://vouch.sh/docs/cicd/): Require a YubiKey tap before production deployments — hardware-verified identity embedded in every CI/CD credential. (~1140 tok)
- [Getting Started](https://vouch.sh/docs/getting-started/): Install the Vouch CLI, enroll your YubiKey, and replace static secrets with hardware-backed credentials in minutes. (~2500 tok)

## Product

- [Compare](https://vouch.sh/compare/): How Vouch compares to Teleport, HashiCorp Vault, AWS IAM Identity Center, and 1Password

## Optional

- [About](https://vouch.sh/about/): Learn about Vouch and Smoke Turner, LLC
- [Privacy Policy](https://vouch.sh/privacy/): Privacy policy for vouch.sh
- [Terms of Service](https://vouch.sh/terms/): Terms of service for vouch.sh