Local-first OAuth credential broker that serializes single-use refresh-token rotation across concurrent CLI processes and AI agents
Developers running multiple CLI processes, parallel AI coding agents, cron jobs, or multi-tab clients against the same OAuth credentials keep getting logged out, because providers like Anthropic MCP and OpenAI Codex now use rotating single-use refresh tokens. When two processes read the same refresh token and both redeem it, the first wins and the rest are de-authed with refresh_token_reused or invalid_grant. The fix devs keep describing is a small local broker daemon that owns the refresh state, serializes the read-refresh-write cycle behind a lock, and vends fresh access tokens to every process, provider-agnostic and with no enterprise identity provider required.
Do not try to fix this inside each app. Ship one tiny local broker (Unix socket or localhost) that becomes the single refresh authority, so every process asks it for an access token instead of touching the shared credentials file and rotation happens once behind a lock. singleflight plus atomic temp-file rename plus a short grace window on the previous refresh token covers nearly every reported failure mode, and provider adapters are thin.
landscape (3 existing solutions)
The industry is converging on a credential-broker or sidecar pattern in 2026, but shipping options are either enterprise-IdP-bound or vault-flavored. The local-first, provider-agnostic broker for N processes sharing one rotating refresh token does not exist, so every CLI and agent reimplements (or skips) the locking and hits the same race.