Let your agent ask before it acts.
Your agent POSTs "may I do this?" to one URL. You approve or decline from your phone. The agent gets the answer by polling or by a signed webhook. Works with any agent framework or model.
Create an agent
Your agent is ready
Copy these now. They are shown once and only their hashes are stored, so they cannot be recovered.
Agent token (goes in your agent's config; lets it ask, not approve)
Approver link (open on your phone and add to your home screen; anyone with it can approve)
Webhook signing secret (verify the X-Relay-Signature header)
Ask for approval from your agent
Check the answer
Treat anything other than approved as a no. Requests expire after 15 minutes by default (expiresInSeconds, 60 to 86400).
How it works
- Ask:
POST /api/requestswith the agent token and{"action": "Refund order #1042", "details": "..."}. Send anIdempotency-Keyheader so retries never create duplicates. - Decide: the request shows up on your approver page. Tap Approve or Decline, with an optional note.
- Act: the agent polls
GET /api/requests/{id}, or your webhook receives a signedapproval.decidedevent.
Security model
- Two separate secrets: the agent token can only ask; the approver key can only decide. An agent cannot approve itself.
- Secrets are stored as SHA-256 hashes. The approver key lives in the link's #fragment, so it is not sent in page requests or referrers.
- Every decision is one-shot: a request can be decided once, and never after it expires.
- Webhooks are HMAC-SHA256 signed with a timestamp (
t=…,v1=…). Reject events older than 5 minutes and dedupe on the request id to stop replays. - Webhook URLs must be public https hosts. Private and internal addresses are refused, DNS is checked on every send, and redirects are not followed.
No AI model is involved. Approval Relay stores the action text you send, so do not put passwords, card numbers or other secrets in it.
Pricing
Free: one agent, a mobile approval page, polling and webhook decisions, and a short audit log. Up to 100 requests per agent per month.
Pro (in development): unlimited requests, multiple agents and approvers, auto-approve and auto-deny rules, and audit log export. Early access is open now as a $10 one-time pre-order.
Pro
Multiple agents and approvers, rules, log export.