Skip to content
OpenMatterOpenMatterOpenMatter

Credentials

Provider installation secrets stay outside events, context, Agent input, profiles, and receipts.

interface CredentialRequest {
  integrationId: string;
  authority: string;
}


interface CredentialResolver<Credential> {
  resolve(request: CredentialRequest): Effect<Credential, CredentialError>;
}

A Work Integration asks for the current credential of one trusted authority. The resolver may read an environment variable, encrypted database, user-owned OAuth service, OpenMA, or a future managed control plane.

Use a resolver

Section titled “Use a resolver”
const credentials = makeCredentialResolver(async (request) => {
  return credentialVault.resolve(
    request.integrationId,
    request.authority,
  );
});


const slack = makeSlackIntegration({ credentials });

makeCredentialResolver adapts synchronous, Promise, and Effect loaders to one typed failure boundary. staticCredentialResolver binds one explicit installation and rejects every other authority.

Where OAuth belongs

Section titled “Where OAuth belongs”

OpenMatter follows the same boundary as Spectrum: the SDK consumes provider credentials and may provide token-renewal utilities. Authorization pages, callbacks, PKCE/state, installation storage, secret vaults, revocation, and management UI belong to user code or an optional control plane.