dsh-authmux

Juggling subscriptions across OpenAI, Anthropic, xAI, OpenRouter, and other providers means juggling OAuth flows in separate tabs, with credentials scattered and refresh logic duplicated. DSH AuthMux collapses all subscription-based provider sign-ins into one compact login surface while DeepSeek Harness Core keeps full ownership of credentials, model routes, and token refresh. You authorize once in Settings, pick any enabled provider from the standard model selector, and you are done.

Architecturally, AuthMux owns only the browser interaction bridge and the UI. Model transport, PKCE, device-code flows, and token refresh all stay inside the Core llm-pi-ai pipeline; OAuth payloads never cross into the browser, the RPC channel is loopback-fenced, and model tools cannot reach the authorization surface. When migrating from the legacy dsh-simple-oauth, AuthMux auto-detects the old credential file, imports valid records into Core, enables the corresponding model routes, and renames the original as a .migrated backup so nothing is lost.

It is built for developers who maintain multiple model subscriptions and want a single DSH-managed authentication experience, and for teams moving off dsh-simple-oauth who need clearer security boundaries and a cleaner provider abstraction.