Skip to content
AI Approvel

Early access · free for 100 approvals a month

Human approval your AI agents can't skip.

When an agent is about to move money, issue a refund or change an account, AI Approvel puts the decision in front of a person on WhatsApp or SMS, then hands your agent a signed record that anyone can verify.

Get started freeRead the docs

No credit card · WhatsApp & SMS · Ed25519-signed audit trail

Illustrative example. Hashes are shortened; the shapes match the API.

  • WhatsApp & SMS via Twilio
  • Ed25519-signed hash chain
  • HMAC-SHA256 webhooks
  • 60 requests / min per project

How it works

One API call. One person. One receipt.

Three steps, the same shapes you will find in the API reference.

  1. 01

    Your agent asks

    One POST when the agent reaches a risky action. The call returns 202 with an id while the message is delivered in the background. Nothing runs until someone decides.

    bash
    # APPROV_API_BASE = https://<project>.supabase.co/functions/v1/approvals
curl -X POST "$APPROV_API_BASE/" \
  -H "Authorization: Bearer $APPROV_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "approver_id": "apr_...",
    "action": "Wire $18,500.00 to Contoso Ltd",
    "amount": 18500,
    "currency": "USD",
    "callback_url": "https://agent.example.com/hooks/approv"
  }'

# 202 Accepted
# { "id": "req_9f2a…", "status": "pending", "expires_at": "2026-07-14T12:19:02Z", "replayed": false }
  2. 02

    A person decides

    The approver you chose gets the action, the amount and two buttons on WhatsApp, or the same request by SMS. The first reply is the decision. Unanswered requests expire.

  3. 03

    You get a signed record

    The decision is POSTed to your callback_url with an HMAC signature, and every step, from created to decided, is appended to a hash chain signed with Ed25519.

    http
    POST https://agent.example.com/hooks/approv
Content-Type: application/json
X-Approv-Timestamp: 1752494771
X-Approv-Signature: 5f1d3c8e…   # hex HMAC-SHA256 of "<timestamp>.<raw body>"

{
  "event": "approval.decided",
  "id": "req_9f2a…",
  "outcome": "approved",
  "decided_via": "whatsapp",
  "decided_at": "2026-07-14T12:06:11Z",
  "action": "Wire $18,500.00 to Contoso Ltd",
  "amount": 18500,
  "currency": "USD",
  "context": { "ticket": "FIN-2210" }
}

Poll GET /:id instead of using webhooks if you prefer. Full API reference

What you get

"Sent" is not "approved."

A notification can be ignored, spoofed or answered twice. AI Approvel is a control: the action waits for a recorded decision.

  • WhatsApp first, SMS fallback

    Messages go out on WhatsApp through Twilio and fall back to SMS. Delivery is recorded as its own signed event, so you can see when the message landed.

  • Links that bots cannot trigger

    Approval links open a confirmation page and the decision is recorded only when the approver taps. Link previewers and security scanners that follow URLs cannot decide on anyone's behalf.

  • First reply wins

    An approval is decided exactly once. A late or duplicate reply does not flip it, and the decision is bound to the request your agent created.

  • Signed webhooks

    approval.decided is POSTed to your callback_url with an HMAC-SHA256 signature over the timestamp and raw body. Non-2xx responses retry with backoff, and every attempt is logged.

  • A trail anyone can verify

    Each event hashes the one before it and is signed with Ed25519. The API returns the public key and the exact formula, so you or an auditor can verify the chain offline. Download it as JSON from any approval.

  • Keys and limits you can reason about

    API keys are scoped to one project, stored as a hash and shown once. Each project may create 60 approvals a minute; past that you get 429 with a Retry-After header.

Built for compliance

The oversight step and the log, as code.

Article 26 of the EU AI Act sets obligations for deployers of high-risk AI systems. Two of them map directly onto what AI Approvel produces.

Whether the Act applies to your system, and in which risk class, is a question for your counsel. This describes the product; it is not legal advice.

Art. 26(2) · human oversight

A named person decides

Deployers must assign human oversight to natural persons with the necessary competence, training and authority. AI Approvel routes each decision to an approver you choose and records who decided, over which channel, and when.

Art. 26(6) · logs

A log you can keep and prove

Deployers must keep the logs their high-risk system generates, for at least six months unless law provides otherwise. Every approval produces a hash-chained, Ed25519-signed trail you can export and verify offline.

Security

Built so you don't have to take our word for it.

The record of every decision has to be trustworthy, and provably so. These are the mechanisms, not promises.

  • Hash-chained, Ed25519-signed events

    Change any past record and the chain breaks. The response ships the public key and the hashing formula so verification never depends on us.

  • HMAC-signed webhooks with replay protection

    X-Approv-Signature covers the timestamp and the raw body. callback_url must be https on a public host; private and metadata addresses are rejected.

  • Encrypted in transit and at rest

    TLS everywhere, encryption at rest in Postgres, and signing keys held in an isolated vault separate from application data.

  • Hardened by default

    Strict Content-Security-Policy, HSTS with preload, X-Frame-Options DENY, a Referrer-Policy and a Permissions-Policy on every response.

SOC 2 Type II is on the roadmap. Read the security page

Pricing

Start free. Pay when agents go to production.

Usage is counted per approval created. Reads, reminders and the approver's reply are never counted.

  • Free

    $0/ month

    100 approvals a month

    1 approver, community support

  • Most popular

    Growth

    $99/ month

    5,000 approvals a month

    Unlimited approvers, webhooks, export

  • Scale

    Custom

    Volume approvals

    Retention, dedicated signing key, SLA

Compare plans Upgrade from inside the app, cancel any time.

Put a person in the loop before your agent ships.

Create an account, add an approver, send your first approval. Free for 100 approvals a month.

Create a free accountTalk to us