Self-host an open-source support agent that keeps the credentials

The connection is the thing you are choosing

A support agent that answers from help center articles needs one connection. An agent that looks up an invoice, changes a plan or fixes a bug in the product needs three: the helpdesk, the billing system, the codebase. Each is a credential that some machine presents on your behalf, and where that credential is kept decides more about the deal than the code does.

Hosted agents, the kind sold alongside a helpdesk, all run the same way. You authorize the vendor once in its dashboard, the vendor's servers keep the token, and the agent spends it when it acts. The work is real, and some integrations are good. What you do not get is custody of the token: you cannot read it, rotate it on your own schedule, or see which call spent it beyond the log the vendor shows you. That is the shape of a hosted service rather than a fault in any product, and reading the source alone does not settle it. An agent you can read, still run through somebody else's server, leaves the credentials on that server.

Self-hosting moves that one thing, and the code was never the scarce part.

What the instance holds

Install Kortix on a Linux server and you get one Docker Compose stack: the web app, the API, the LLM gateway, Postgres and the rest of the Supabase distribution, plus Caddy in domain mode. Sessions do not run on that server. They run on Platinum sandboxes that call back to the instance's public API.

Four properties matter for a support queue, and each is stated in the product's own terms:

• Hosting. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.
• Connector credentials. Connector credentials are brokered server-side and never enter the machine. The Gmail token stays with the API, not inside the session that reads the thread.
• Secrets. Secrets are encrypted at rest with a key per project. That key is API_KEY_SECRET in the instance .env, and losing it makes every stored credential unreadable, so copy the file somewhere safe before the first customer writes in.
• Sessions. One isolated sandbox per session. Each session has its own isolated machine and branch. Two threads worked at once do not share a checkout.

What self-hosting does not do is remove the network. The instance has to be reachable from the internet, because the sandbox running a session calls back to it, including on-premise.

The block that turns it into a queue worker

A support inbox in a manifest is one connector and one trigger. The connector points at Gmail's MCP server, and an event trigger opens a session with the subject and the sender in the prompt whenever a message lands on the address. It is text in kortix.yaml at the root of the project repo, so a change to it travels through the same review as a change to code.

The pattern comes from Kortix's own support operation. Each inbound thread opens its own session, scoped to the product's knowledge, the codebase and Stripe, and the agent stops at a person for sensitive actions. What matters is that each session's reach is a line in a file somebody reads before it goes live. A rule in the same file can hold a call until a person decides.

What self-hosting costs

Three bills arrive instead of one invoice, and none of them is small enough to leave out of a pilot.

The machine. A Linux server with a public IP, ports 80 and 443 open, and DNS records for the domain, the API subdomain and a wildcard for previews. Caddy needs those records before the first start, because it fetches the certificate itself. The API reserves 2 GB of memory by default and Postgres a fixed 1.28 GB. One modest box carries a support team's agent, and somebody patches it.

The model bill. A self-hosted instance has no Kortix-managed models. Each project brings a provider key, and inference arrives on that provider's invoice. A support queue is the awkward case. An easy message costs almost nothing, while a thread that reads the repo costs a lot. The bill tracks the mix of work rather than the number of agents.

The upgrade path. kortix-updater checks once a day, migrates the database and rolls the services. A failed migration leaves the previous version serving, and two replicas roll without a gap. Tracking stable rather than latest is a call somebody owns, and so is reading kortix self-host status on the morning it reports degraded.

The work that stays yours either way: writing the agent's instructions, keeping the helpdesk, and answering the queue when the stack is down.

Where a vendor's bill is the better buy

None of this makes a hosted agent a bad purchase. Intercom's Fin is $0.99 per outcome, with a $49 a month minimum that includes 50 outcomes, and no seat costs for Fin. It works with any helpdesk, including Salesforce and Zendesk. If the job is answering from articles on a helpdesk the team already likes, that is a far shorter path than a server, a domain and a model key.

The per-agent plans are plain about their shape too. Zendesk charges per agent a month, and an extra automated resolution is €1.50. Agentforce meters actions in Flex Credits, and Lindy sells credits per active seat. A five-person team can price all three in an afternoon and pay nothing for infrastructure.

The self-hosted route wins on one condition: the agent has to reach something the vendor cannot see. The repo behind the product, the billing account, an admin tool nobody outside the company may touch. At that point the connection is the product, and a monthly fee for a connection you do not hold becomes the expensive option.

Trying it before you commit

kortix self-host init --tunnel cloudflare starts a stack on your own machine with no domain. The web app answers on localhost, cloudflared publishes the API at a temporary public address, and sessions run because the sandbox can reach it. A quick tunnel changes that address on every restart, which breaks any OAuth callback registered against it, so keep a named tunnel.

A local install with neither a domain nor a tunnel publishes nothing: every port binds loopback and the sandbox cannot reach the API, so no session runs.