Skip to main content
The Toolshed API server is built with Hono and deployed to Vercel. All endpoints are under the /api base path.

​
Authentication

All routes require a Bearer token in the Authorization header, validated against the TOOLSHED_API_SECRET environment variable. 
Authorization: Bearer <TOOLSHED_API_SECRET>
Exceptions (no auth required):
  • GET /api/health
  • GET /api/auth/:provider/login
  • GET /api/auth/:provider/callback

​
Route groups

GroupPath prefixDescriptionStatus
Auth/api/authOAuth2 login, callback, disconnect, list connectionsImplemented
Tokens/api/tokensVend short-lived access tokens for pluginsImplemented
Registry/api/registryTool catalog, source registration, searchImplemented
Policy/api/policyRole management and access resolutionStub
Audit/api/auditAudit trail for tool invocationsStub
Elicitation/api/elicitationPending approval storage and resolutionStub

​
Health check

GET /api/health
→ { "ok": true }