Common Thread — AI Account Connection SDK

One typed SDK for connecting ChatGPT, Claude, Gemini, and Grok accounts, discovering entitled models, and routing canonical text requests through the user's own allowance.

Quickstart · Integration guide · Architecture · Security

This is an SDK for developers building AI applications—not a hosted consumer product. It extends the original Login with ChatGPT architecture into a provider-neutral connection layer. Hosted providers keep credentials behind an HttpOnly server session. Local-only integrations use a loopback bridge with an origin allowlist, one-time terminal pairing, origin-bound capabilities, and replay-protected nonces. Provider tokens never enter application JavaScript.

What works

Provider path	Authorization	Usage source	Readiness
ChatGPT	Existing device/loopback OAuth handler	ChatGPT consumer plan	Stable base implementation
Claude	Hosted or loopback OAuth using registered/partner-approved configuration	Approved Claude entitlement	Partner configuration required for hosted production
Gemini Developer API	Google OAuth + PKCE	Google Cloud/AI Studio project	Supported, but not a Gemini Apps plan
Gemini consumer	Google OAuth + private Antigravity protocol	Account's Antigravity/Google AI allowance	Experimental and unsupported; explicit account-risk consent required
Grok Build	Official grok login + ACP	Whatever entitlement the official CLI exposes to its cached login	Account-dependent; isolated cached-login profile

The SDK does not pretend that identity OAuth automatically grants inference or that every allowance is interchangeable. Every adapter publishes its actual usageSource and capability notes.

Run the complete demo

bun install
bun run demo:providers

Open http://localhost:3102. The demo includes four connection cards, structured pairing (no native browser prompt), model discovery, model selection, cancellation, and a canonical text-generation workbench.

Start any local bridges you want to exercise in separate terminals:

CLAUDE_BRIDGE_ALLOWED_ORIGINS="http://localhost:3102" \
CLAUDE_BRIDGE_VAULT_SECRET="replace-with-at-least-32-random-characters" \
bun run packages/claude-bridge/src/cli.ts

GEMINI_CONSUMER_ALLOWED_ORIGINS="http://localhost:3102" \
bun run packages/gemini-consumer-bridge/src/cli.ts

GROK_BRIDGE_ALLOWED_ORIGINS="http://localhost:3102" \
bun run packages/grok-bridge/src/cli.ts

See the demo guide for the complete pairing and provider setup.

Unified application API

import {
  GEMINI_CONSUMER_RISK_ACKNOWLEDGEMENT,
  createChatGPTConnectionAdapter,
  createClaudeBridgeConnectionAdapter,
  createGeminiConsumerConnectionAdapter,
  createGrokConnectionAdapter,
} from "@opencoredev/ai-connection-adapters";
import { AIProviderPicker } from "@opencoredev/ai-connection-react";

const requestPairingCode = async ({ pairingId, expiresIn }) => {
  // Render your own trusted dialog and resolve with the terminal-visible code.
  return showPairingDialog({ pairingId, expiresIn });
};

const adapters = [
  createChatGPTConnectionAdapter({ basePath: "/api/chatgpt" }),
  createClaudeBridgeConnectionAdapter({ requestPairingCode }),
  createGeminiConsumerConnectionAdapter({
    requestPairingCode,
    userRiskAcknowledgement: GEMINI_CONSUMER_RISK_ACKNOWLEDGEMENT,
  }),
  createGrokConnectionAdapter({ requestPairingCode }),
];

export function Connections() {
  return <AIProviderPicker adapters={adapters} />;
}

Every adapter implements the same core methods:

await adapter.status();
await adapter.authorize();
const models = await adapter.listModels();
const response = await adapter.generate({
  model: models[0].id,
  messages: [{ role: "user", content: "Explain PKCE simply." }],
});
await adapter.disconnect();

Security boundaries

• Hosted access and refresh tokens stay behind the application server.
• Gemini consumer tokens are stored only in macOS Keychain or Linux Secret Service, as a versioned record bound to the owning web origin.
• Gemini consumer refresh, callback, and logout mutations are serialized so a stale refresh cannot resurrect or overwrite credentials.
• The Gemini experimental bridge is single-account, production-endpoint-only, Gemini-model-only, rate-limited, output-capped, and never imports cookies or rotates accounts.
• Grok runs with isolated HOME and GROK_HOME directories and accepts only the official CLI's cached_token ACP method. The bridge scrubs API-key environment variables and rejects custom endpoints in its dedicated profile; the official CLI remains the authority on the account's exact entitlement.
• Grok ACP starts with updates, tools, web search, memory, subagents, and project access disabled, in an empty directory under the CLI's strict sandbox. The bridge stops the process if that sandbox cannot be enforced.
• Loopback discovery starts only after a user clicks Connect, avoiding surprise Local Network Access permission prompts on page load.
• Browser capabilities are memory-only by default. Reloading requires pairing again; applications that persist them must explicitly accept the added XSS exposure.

Experimental Gemini consumer warning

The Gemini consumer packages use an unsupported private Google Antigravity protocol and require separately configured, authorized OAuth credentials. Google may change or disable the protocol, restrict Google AI access, or restrict the connected account. Applications must show the exact risk acknowledgement and obtain an explicit user action before enabling it. The packages are published only under the experimental npm tag and include the upstream research notice.

This repository does not include Google's first-party client ID or client secret. The bridge fails closed unless GEMINI_CONSUMER_CLIENT_ID and GEMINI_CONSUMER_CLIENT_SECRET are provided by the operator.

Package map

• @opencoredev/ai-connection-core — canonical manifests, connection states, models, and generation contracts.
• @opencoredev/ai-connection-adapters — concrete ChatGPT, Claude, Gemini, and Grok adapters.
• @opencoredev/ai-connection-react — provider-neutral hook and connection UI.
• @opencoredev/loginwithchatgpt-* — original ChatGPT backend, React, and AI SDK implementation.
• @opencoredev/loginwithclaude-* — Claude core, hosted handler, loopback bridge, browser client, React, and AI SDK packages.
• @opencoredev/loginwithgemini-* — supported Developer API OAuth path.
• @opencoredev/loginwithgemini-consumer-* — explicitly experimental consumer protocol, keychain, bridge, and browser client.
• @opencoredev/loginwithgrok-bridge* — official Grok Build ACP bridge and browser client.

Detailed architecture and provider distinctions are in the multi-provider guide. The original ChatGPT quickstart and security documentation remain available under docs/.

Developer documentation

• Integration guide — install, configure adapters, build custom UI, generate, and prepare for production.
• Architecture — package layers, hosted and local lifecycles, canonical contracts, and failure semantics.
• Provider setup — exact prerequisites and honest usage boundaries for every provider path.
• Security model — assets, controls, threat model, and vulnerability-reporting expectations.
• Open-source release guide — repository, release, packaging, and public-messaging checklist.
• Reference demo — a working integration playground developers can inspect and adapt.

Validation

bun run typecheck
bun test packages
bun run build
bun run --cwd examples/all-providers-demo build

MIT licensed. Third-party protocol-research attribution is recorded in THIRD_PARTY_NOTICES.md.

For a first multi-provider publication, use bun run release:all. It publishes the experimental Gemini consumer dependencies before the stable unified adapter that references them, then publishes the remaining provider packages in dependency order.