Self-hosting
Run Open Connector in your own environment while preserving the same platform and API model.
Self-hosting is for teams that need to operate Open Connector, the database, encryption keys, and OAuth applications in their own environment. It is not required for the SaaS quick start.
What you operate
| Component | Responsibility |
|---|---|
| API server | OAuth callbacks, project-key authentication, authenticated tool calls, and API routes |
| Postgres | Application state and encrypted credential records |
| Encryption key | CONNECTOR_ENCRYPTION_KEY; losing it makes existing encrypted credentials unrecoverable |
| Public HTTPS origin | OAuth callback base and API endpoint for your agents |
| OAuth applications | Provider-specific client credentials when you do not use an available managed configuration |
The optional console is useful for operating organizations, projects, auth configs, connections, and API keys. Agents still call the project-key-protected API; they do not access the database directly.
Choose the right guide
Local development
Run the repository's Postgres, MinIO, and observability dependencies, then start the applications with pnpm.
Cloudflare production deployment
Workers, Containers, Queues, R2, Cloudflare secrets and Postgres.
Environment variables
Use the validated runtime schema as the source of truth for required and optional configuration.
Database operations
Run migrations, understand local database setup, and plan backups.
Production shape
The maintained production deployment uses Cloudflare Workers and Static Assets for sites, a Worker-fronted Node Container for the API, native Queues and Cron for background processing, R2 for blobs, and Neon/Postgres for state. Runtime secrets are scoped to each Cloudflare Worker. CI receives a separate database credential for migrations.
Follow Deploy to Cloudflare for account configuration, secret handling, deployment and verification.
Before production
- Generate and back up
BETTER_AUTH_SECRETandCONNECTOR_ENCRYPTION_KEYsecurely. - Set the server's public URL and CORS origin correctly.
- Register each provider OAuth callback against the API server's public origin.
- Run database migrations as part of the deployment process.
- Verify a project API key, a real connection, and one authenticated tool call from the public endpoint.
A database backup alone cannot decrypt credentials. Protect and recover the encryption key using a real secrets-management process.