Self-hosting on Kubernetes

AgentKitProject is designed to be self-hosted: local-first, open ecosystem, no vendor lock-in. The same web and worker images run on hosted (managed Kubernetes / DOKS) or self-hosted infrastructure, with cloud coupling abstracted behind swappable adapters.

Helm charts

The deploy/charts/ directory provides charts for each self-hostable service:

Authentication: WorkOS or OIDC

Auth is pluggable. The hosted default is WorkOS; for self-hosting, set the auth provider to OIDC and point it at your own identity provider:

• Set the OIDC issuer, client ID, and client secret, plus the app URL.
• Users live in your IdP — there's no in-app signup or user table. The first OIDC sign-in provisions a session from the token claims; you onboard and offboard users in your IdP.
• Admins are resolved by OIDC group (ADMIN_OIDC_GROUP) and/or an email allowlist (ADMIN_EMAILS).
• Display names & publisher attribution come from the IdP, so kit submission works without running the optional Profile service — leave PROFILE_API_BASE_URL unset.
• On self-host, sign-in is required by default: when AUTH_PROVIDER=oidc (or SELF_HOST=true), Market defaults to REQUIRE_LOGIN=true, so there is no anonymous catalog. Set REQUIRE_LOGIN=false if you want a public self-hosted catalog (login then only gates submit, admin review, and browser-initiated downloads); the hosted public catalog is unchanged.
• Set the cross-app links (NEXT_PUBLIC_FORGE_URL, NEXT_PUBLIC_MARKET_URL, NEXT_PUBLIC_AUTO_URL, NEXT_PUBLIC_PROFILE_URL) so the shared sidebar switcher surfaces the other apps — unset links are simply hidden, and the Docs tab is always available.

Bring your own key

In self-host / OIDC mode, AgentKitAuto runs in bring-your-own-key mode: the operator supplies the LLM key (e.g. ANTHROPIC_API_KEY) at runtime. The managed-credits path (with markup) is a hosted commercial feature; a plain self-hosted install uses your own key with no platform markup.

Quick start (k3s preset)

Each chart ships a values-k3s.yaml preset: OIDC auth, bundled Postgres/MinIO/Redis, plain Kubernetes Secrets, and chart-generated admin/session secrets and DB passwords (persisted across upgrades). For example, Market:

helm install agentkitmarket ./deploy/charts/agentkitmarket \
  -f deploy/charts/agentkitmarket/values-k3s.yaml \
  --set web.config.appUrl=https://market.example.com \
  --set web.ingress.host=market.example.com \
  --set web.config.oidc.issuer=https://idp.example.com \
  --set web.config.oidc.clientId=agentkitmarket \
  --set web.secrets.oidcClientSecret="$OIDC_CLIENT_SECRET" \
  --set web.config.oidc.adminGroup=agentkit-admins \
  --namespace agentkit --create-namespace

The bundled Postgres/MinIO/Redis are single-replica and meant for dev/staging. For production, disable them and supply external connection strings.

Principles

• Local-first by design — most teams never need to self-host.
• No vendor lock-in: AWS/cloud services sit behind swappable ports.
• The same worker/web image runs hosted or self-hosted.
• Self-hosting is additive — run self-hosted Auto with hosted Market, or vice versa.