Corsair — Managed OAuth and API Integration for AI Agents

Introduction

Corsair is an open-source TypeScript platform that handles the OAuth complexity of connecting AI agents to third-party services. Instead of building custom authentication flows for every API, Corsair provides managed OAuth with a unified integration layer, letting agents securely access tools on behalf of users.

What Corsair Does

• Manages OAuth 2.0 flows for connecting agents to user accounts
• Provides unified API integrations across multiple services
• Handles token refresh and credential management automatically
• Supports MCP (Model Context Protocol) for agent tool access
• Enables function calling with pre-authenticated API connections

Architecture Overview

Corsair is built in TypeScript with a server component that manages OAuth state and a client SDK for agent integration. The server handles authorization code flows, token storage, and automatic refresh. Integrations are defined as typed interfaces that map to external APIs, giving agents structured tool access with proper authentication.

Self-Hosting & Configuration

• Install via npm and initialize a new Corsair project
• Configure OAuth credentials for each service integration
• Set up the Corsair server to handle authorization callbacks
• Connect agents through the SDK or MCP protocol
• Manage user consent and token lifecycle through the dashboard

Key Features

• Managed OAuth 2.0 with automatic token refresh
• Pre-built integrations for popular services
• MCP-compatible for direct agent tool access
• TypeScript SDK with full type safety
• Open-source with self-hosting support

Comparison with Similar Tools

• Auth.js — general web authentication; Corsair is purpose-built for agent-to-API connections
• Nango — API integration platform; Corsair focuses specifically on agent workflows
• Composio — AI tool integration; Corsair provides deeper OAuth management and self-hosting
• Zapier — no-code automation; Corsair offers programmatic agent-first integration

FAQ

Q: What OAuth providers does Corsair support? A: Corsair supports any OAuth 2.0 compliant provider and includes pre-built configurations for popular services.

Q: Can I self-host Corsair? A: Yes, Corsair is designed for self-hosting and runs as a Node.js server.

Q: How does Corsair work with MCP? A: Corsair exposes authenticated API integrations as MCP tools that agents can call directly.

Q: Does Corsair store user credentials? A: Corsair stores OAuth tokens securely and handles refresh cycles, but does not store user passwords.

Sources

• https://github.com/corsairdev/corsair