Sign in to provider accounts once and share them across environments (like omp's auth broker)

[al3rez]

Problem

I sign in to the same provider accounts on every environment I use.

My Mac mini runs t3 serve and holds my Claude and ChatGPT logins. My MacBook runs T3 Code locally, and I sign in to the same accounts again there. Every new remote box means another round of OAuth. When a token gets revoked or I add an account, I fix it on each machine by hand.

T3 Code already knows about all of these environments. It just doesn't share provider logins between them. I want one place that holds my accounts, and every environment (including my laptop's local one) uses it.

What main does today (30cc788)

• Each environment keeps its own provider login. The Codex guide tells you to select the remote environment first and sign in there (providers-codex.md). Claude and Codex read credentials from that host's CLAUDE_CONFIG_DIR / CODEX_HOME (ClaudeHome.ts, CodexManagedHome.ts).
• GitHub sharing already solves this for GitHub. An environment can use another connected environment's GitHub credential, opt-in per environment, and the credential stays on its machine (source-control.md). Provider accounts have nothing like it.

Prior art: omp's auth broker

Oh My Pi ships omp auth-broker serve. One host keeps the refresh tokens in its vault and refreshes them in the background. Clients pull a snapshot that has access tokens only; the broker swaps every refresh token for a sentinel. When an access token expires, the client asks the broker to refresh it. omp auth-gateway goes one step further and proxies provider requests, so clients never see a token at all. Docs: auth-broker-gateway.md.

Proposal

Let one environment be the auth home for provider accounts.

1. In Settings → Providers, I pick an environment as the source for an account. My MacBook points at the Mac mini.
2. The source keeps the refresh token and runs every refresh. Other environments get short-lived access tokens and ask the source for a fresh one on expiry. Two machines never race to rotate the same refresh token, which is what breaks today when I copy auth.json around.
3. Gate it like GitHub sharing: off by default, opt in per environment.
4. When I add or sign out of an account on the source, every environment picks up the change.

Codex looks like the easiest place to start. Its app-server already accepts tokens supplied from outside (account/login/start with tokens, then account/chatgptAuthTokens/refresh). #4353 used that path for a different broker before it was closed as accidental.

A smaller first step would also help me: let a provider instance point at an existing omp auth broker URL and token. Some of us already run one.

Related

• Browser profiles: share a custom profile's cookies across all environments #16180, the same per-environment problem for browser profile cookies
• Environment-level MCP servers (and later rules/skills) shared by every provider and account #14118, environment-level MCP servers shared by every provider
• Add optional Jude broker authentication for Codex #4353, broker-backed Codex auth (closed)