What's Next
AuthDeck started as a personal annoyance and ended as a small tool I actually rely on. Along the way it clarified a few things I keep coming back to.
What Worked
The strongest decision was refusing to change the client. Because AuthDeck masquerades as an identity provider, Bruno needed zero special handling. The second was treating provider selection as a runtime action. Once the TUI became the control plane, everything else fell into place.
What I’d Watch
There are obvious limits. Tokens live in memory, so restarting the daemon forgets them. The proxy trusts localhost completely, which is fine for a development tool but not for anything shared. And every new provider is another set of quirks to accommodate.
- Persistence — optionally encrypt and store tokens across restarts.
- More flows — device code, PKCE, and provider-specific extensions.
- Guarded modes — opt-in restrictions so it can run beyond a single machine.
The Point
None of this is meant to become a platform. The value is in staying small: one endpoint, one clear job, and a UI that asks the right question at the right moment.
Small tools earn their keep by doing one thing cleanly. AuthDeck’s job is to make OAuth invisible to the tools that don’t want to think about it—and to let me decide who issues the token, right when it matters.