custom-auth

A generic core-auth provider for user-configured HTTP AI endpoints. Instead of one upstream vendor, it drives any number of endpoints declared in its own config, each with its own wire format, translating canonical IR to and from that format via a translator submodule (openai-translator, more later). The API key for each endpoint is never stored in config: it lives in core-auth's account store, reachable only through the Accounts menu.

Under-the-Hood Architecture

flowchart LR
  A[IR request] --> B{split model}
  B -->|endpointId| C[select endpoint config]
  C -->|endpoint.format| D[select translator]
  D --> E[translator.encodeRequest]
  E --> F[fetch endpoint.baseUrl]
  F -->|stream| G[translator.decodeStream]
  F -->|non-stream| H[translator.decodeResponse]
  G --> I[IR event stream]
  H --> J[IR response]

Loading

Structure

• src/
  • src/driver.ts, the provider: resolves the endpoint + translator for a model, calls handleIr(), and declares the endpoints setting.
  • src/endpoints.ts, endpoint config lookup, model-name splitting, and the key store bridge (saveKey/keyFor) into core-auth's accounts.
  • src/handler.ts, Claude entry (exposes the IR-native handleIr the proxy front-door calls).
  • src/index.ts, OpenCode entry (defineProvider(driver).opencode) and the /custom-auth-config CLI guard.
  • openai-translator/, core-auth/, core/, git submodules (the OpenAI wire translator; the auth engine; shared config/logging), bundled in.
• dist/
  • dist/index.js, dist/handler.js, dist/driver.js, esbuild bundles the submodules in, producing self-contained entries; not committed.

Installation

Via plugin-updater (recommended)

npx plugin-updater@latest init https://github.com/intisy-ai/custom-auth

Via npm

npm install custom-auth

This package publishes under two names: custom-auth and @intisy-ai/custom-auth, both resolving to the same build.

Configuration

Config file: <configDir>/config/custom-auth.json (edit via the loader or /custom-auth-config set).

{
  "endpoints": [
    { "id": "local", "label": "Local endpoint", "baseUrl": "https://api.example.com/v1", "format": "openai", "models": ["gpt-4o"] }
  ]
}

Field	Meaning
id	Short identifier used as the model prefix.
label	Display name shown in the loader.
baseUrl	The endpoint's base URL (its /chat/completions path is appended).
format	The wire format to translate through (currently openai).
models	The upstream model names this endpoint serves.

The API key for an endpoint is never part of this file. It is stored via core-auth's account store (saveKey, reachable through the Accounts menu), keyed to the endpoint's id, so it never appears in a config diff or a shared config export.

Usage

Each endpoint's models are advertised namespaced as <endpointId>/<upstreamModel>, for example local/gpt-4o. Selecting one of these models routes the request through that endpoint's translator; the <endpointId> prefix is stripped before the request reaches the upstream service.

License

MIT.