Documentation

Overview

MinhAgent runs as two Cloudflare Workers: a web app at minhagent.dev and a GitHub webhook receiver. Authentication is handled by Clerk; the web app also acts as an OAuth 2.0 provider so native clients can sign in and read your configuration.

GitHub automation

The webhook worker verifies each delivery's HMAC-SHA256 signature against your GITHUB_WEBHOOK_SECRET, then routes the event into a Cloudflare Workflow. Point a repository or org webhook at the receiver and pick the events you care about.

# webhook endpoint
https://minhagent-webhook.duyet.workers.dev

LLM gateway

Store one provider key (AnyRouter or OpenRouter) from the dashboard. Native clients fetch it over an authorized request and route model calls through it — the key stays in your account and never ships with the app.

OAuth & native apps

The native client (minhagent-app) uses OAuth 2.0 with PKCE, redirecting to minhagent://oauth/callback. After consent, exchange the code for tokens and call the API with a bearer token.

curl https://minhagent.dev/api/me/anyrouter \
  -H "Authorization: Bearer $TOKEN"

Refresh tokens are single-use and rotate on every exchange. Revoking a grant from the dashboard invalidates its token pair immediately.

Dashboard

The dashboard is where you save or remove your gateway key and review connected apps. Each connected app can be revoked individually.