Skip to main content
Cowork is a multi-agent runtime that supervises several agents running concurrently. Authsome pairs naturally: give each agent its own profile so credentials never bleed between roles.

​
Per-agent profiles

# create profiles for each agent role (programmatic; see below)
# then login with the right home dir for each
AUTHSOME_HOME=~/.authsome-pr-bot   authsome login github
AUTHSOME_HOME=~/.authsome-reviewer authsome login github --connection read
Each profile has its own vault file, own audit log, own master-key access. An agent running with AUTHSOME_HOME=~/.authsome-pr-bot cannot reach credentials in ~/.authsome-reviewer. To create named profiles inside a single AUTHSOME_HOME: 
from authsome.server.dependencies import create_auth_service

auth = create_auth_service()
auth.create_profile("pr-bot", description="Auto-PR agent")
auth.create_profile("reviewer", description="Code review agent")

​
Run each agent under its own proxy

AUTHSOME_HOME=~/.authsome-pr-bot \
  authsome run -- python pr_bot.py

AUTHSOME_HOME=~/.authsome-reviewer \
  authsome run -- python reviewer.py
Each agent’s HTTP_PROXY points at a different daemon instance, each backed by a different vault. The agents cannot read each other’s credentials even if one is compromised.

​
Multi-agent best practices

  • One profile per role, not one per developer. A developer with two agents should still have two profiles.
  • Audit each profile separately. audit.log is per-AUTHSOME_HOME. Logging is easy to forward.
  • Rotate after compromise of one agent only. Other profiles are unaffected.

​
Troubleshooting

SymptomFix
Two agents accidentally share credentialsThey’re using the same AUTHSOME_HOME. Split them.
Port 7998 conflictsEach AUTHSOME_HOME starts its own daemon on its own ephemeral port. Confirm with lsof -i.