Introduction

DSH supports multiple model subscriptions. Each provider typically requires its own OAuth authentication flow. Managing these separate login planes introduces additional operational overhead. dsh-authmux provides a unified authentication entry point, consolidating subscription-based model providers into a single interface.

Plugin Overview

This is a DSH native OAuth multiplexer plugin maintained by Q-xuan.

Its core value is to unify subscription-based model providers into a compact login plane, while DeepSeek Harness Core continues to manage credentials, settings, model routing, and token refresh.

  • Plugin name: q-xuan/dsh-authmux
  • License: MIT

Installation and Enablement

  1. Use the official command to install the plugin:
    dsh plugin --profile web add github:Q-xuan/dsh-authmux
  1. Start the DSH Web interface:
    dsh --profile web

Core Features

The plugin achieves a unified login plane through the following mechanisms:

  • DSH native OAuth multiplexing: Handles the OAuth flow at the Core llm-pi-ai layer.
  • No private credential storage: Authorization credentials are stored in dsh-credentials-local, not in plugin-local storage.
  • No duplicate model adapters: Model requests remain directly at the Core layer; no duplicated adapters are created.
  • Loopback RPC communication: The browser communicates with the service using loopback-fenced DSH Connection RPC.
  • Credential import and routing: Imports valid credentials into llm-pi-ai/Core records and enables the corresponding model routing.
  • RPC channel restriction: The AuthMux RPC channel is restricted to loopback authority for local access only.

Usage

  1. In the DSH Web interface, open Settings.
  2. Go to the AuthMux option.
  3. Complete the login, then select an enabled model from DSH’s standard model selector.

Migration and Compatibility

When the plugin starts, it automatically detects $DSH_HOME/simple-oauth.json. If the file is detected, it will:
1. Import the valid credentials contained in it into llm-pi-ai/Core records.
2. Enable model routing for these credentials.
3. Rename the old file to simple-oauth.json.migrated as a recovery backup.

Security and Considerations

  • Data isolation: OAuth payloads never enter the browser.
  • Refresh mechanism: Token refresh runs in the Core serialized modifyRecord() path.
  • Permission restriction: Model tools cannot invoke the authorization surface.
  • Network restriction: The RPC channel is strictly restricted to loopback authority.
  • Compliance note: Treat each provider’s subscription in accordance with its terms of service and billing rules.

Conclusion

dsh-authmux simplifies the configuration process for multiple model subscriptions through a unified login plane and Core-level credential management. The plugin itself does not hold private keys or store local credentials; it only acts as a UI interaction bridge.