Skip to main content
For teams that need to keep all AI agent traffic inside their own infrastructure, Sesame supports fully self-hosted deployment inside your AWS account. One command provisions the broker, VPC, Secrets Manager integration, and database — and the sesame-onboard skill guides your agent through every step interactively so nothing falls through the cracks.
Self-hosted deployment is intended for enterprise and advanced users. You must have the AWS CLI configured with permissions to create and manage VPCs, Secrets Manager secrets, and database instances before proceeding. Misconfigured IAM permissions are the most common source of deployment failures.

​
Prerequisites

Before starting the onboarding flow, confirm you have the following ready:
  • AWS CLI installed and configured — run aws configure to set your credentials and default region
  • AWS account permissions covering VPC creation, Secrets Manager, and RDS or equivalent database provisioning
  • Google OAuth credentials — you’ll need a client ID and secret from the Google Cloud Console for authentication setup
  • Node.js installed on your machine (required to run npx skills add)

​
Deployment

1

Install the sesame-onboard skill

Run the skills installer and select sesame-onboard from the menu:
Choose sesame-onboard when prompted. The skill is written to your agent’s configuration directory.
2

Run the onboarding skill inside your agent

Start your agent and trigger the sesame-onboard skill. It guides you through the full deployment interactively:
  • AWS CLI login verification — confirms your credentials are active and the correct account is targeted
  • Google OAuth setup — prompts for your client ID and secret, with direct links to the Google Cloud Console to create them if needed
  • Dry-run preview — shows every AWS resource that will be created before any real infrastructure is provisioned, so you can review costs and permissions
  • Final deploy — provisions all resources and outputs your broker endpoint
3

Note your broker endpoint

After a successful deploy, the skill prints your broker’s internal VPC endpoint. Save this — you’ll need it to point the Sesame CLI at your own instance.
4

Configure your sesame CLI to use your broker

Update your local Sesame CLI configuration to route through the self-hosted endpoint instead of the managed service:
Replace <your-vpc-endpoint> with the URL output by the onboarding skill.
5

Verify agent traffic routes through your infrastructure

Start your agent and make an authenticated request. All traffic now stays within your VPC — nothing leaves your AWS account to reach an external broker.

​
What Gets Provisioned

VPC & Security Groups

A dedicated Virtual Private Cloud with security groups scoped to broker traffic only. No public ingress is opened unless you explicitly configure it.

AWS Secrets Manager

All credentials and API keys are stored in your own Secrets Manager instance — Sesame never holds your secret values.

Database

A managed database instance stores audit logs and policy configuration, provisioned inside the VPC with no public endpoint.

Broker Service

The Sesame broker process itself, deployed inside the VPC and reachable only by your agents and Secrets Manager.

​
Security Architecture

How your data is protected at rest and in transit:
  • Secret values are stored in AWS Secrets Manager with encryption at rest using AWS-managed KMS keys (or your own CMK if configured)
  • Application data lives in PostgreSQL with row-level security enabled — each tenant’s data is isolated at the database layer
  • All connections between the broker, agents, and Secrets Manager use TLS; no plaintext communication paths are opened during provisioning

​
Not Ready to Self-Host?

If your team doesn’t need data residency or a dedicated VPC, the managed Sesame broker at getsesame.dev is production-ready with zero infrastructure overhead. You can always migrate to a self-hosted deployment later without changing how your agents are configured.