Library

Approvals

View as Markdown

How calls that change data pause for the user, and how approval tokens are bound to the exact arguments.

Calls that change data (anything that is not GET) need the user's approval. The agent pauses and the UI shows the exact call: operation, path and arguments. The user approves or rejects.

  • The server issues a signed approval token bound to the exact arguments. Changing an argument invalidates the token.
  • Tokens expire. The UI restores a pending approval after a page refresh.
  • Set approvalSecret yourself when more than one instance serves the agent.

To force or skip the step for one operation, use x-agent.approval (Operations).