Get human approval for the exact action before your AI agent executes it.

Live demo

Try a critical-action approval

Create a real approval request bound to a demo payload {"to":"acct_8821","amount_usd":4200,"memo":"INV-2025-118"} — the same example shown above. Review the exact action, approve it with your device passkey, and see the signed decision returned to the system. The same routes power production.

What to gate

Actions that should not run silently

Put an explicit approval in front of the irreversible, costly, or externally-visible calls your automation, agents, and services make.

• Payment Refunds, payouts, invoices, plan changes
• Production Deploys, config changes, database writes
• Destructive Delete or export data, drop resources, rotate secrets
• External Customer emails, Slack posts, support replies
• Admin API MCP tools, user deletion, permission changes, billing
• Code Merge a high-risk PR, trigger a release

Who it's for

One gate, three jobs

How it works

Three steps, one binding

Critical action → passkey approval → signed decision → audit trail

1. 1. Your system requests approval

   An MCP tool call or a single HTTP request — from your agent, script, CI/CD pipeline, or backend service — carries the exact action payload.

   // MCP tool: request_human_approval
   {
     "action": "Wire transfer to vendor",
     "payload": { "to": "acct_8821", "amount_usd": 4200, "memo": "INV-2025-118" },
     "approver_username": "alex"
   }

   curl -X POST https://cosignet.com/api/confirmations \
     -H 'content-type: application/json' \
     -H 'X-Api-Key: $COSIGNET_API_KEY' \
     --data '{"username":"alex","action":"Wire transfer to vendor",
       "payload":{"to":"acct_8821","amount_usd":4200,"memo":"INV-2025-118"}}'

2. 2. The approver reviews the exact action

   The approver opens the link and sees a clear, field-by-field breakdown of the exact action — not raw code — then signs it with a passkey. User verification is required. Every field of the signed payload is shown, and the raw payload plus its SHA-256 are one tap away for verification.

   Action:      Wire transfer to vendor
   To:          acct_8821
   Amount Usd:  4200
   Memo:        INV-2025-118
   sha-256:     ead3…ff31   ← the exact data being signed

   Challenge = nonce ‖ SHA-256(payload). What the approver saw is what got signed.

3. 3. Cosignet returns a signed decision

   The status flips to approved with the raw WebAuthn assertion stored as proof. The assertion is bound to the challenge, so it cannot be replayed against a different payload.

   GET /api/confirmations/{id}
   {
     "status": "approved",
     "payloadHash": "ead3…ff31",
     "credentialId": "…",
     "rawAssertion": { "response": { "clientDataJSON": "…", "signature": "…" } }
   }

Why not just ask in Slack?

A confirmation says “yes”. Cosignet signs what was approved.

A well-designed native approval can stop a specific tool call inside its own platform. Slack and workflow approvals can also provide useful operational records. What they do not usually provide by default is portable cryptographic evidence that can be verified independently of the platform that requested the approval.

Cosignet adds a WebAuthn signature over the exact payload hash and a cross-platform transparency record. Change any field after approval and the signed decision no longer matches — so the approval is evidence about a specific operation, not just UI reassurance. It complements native approvals, IAM, and audit logs; it does not replace them.

Integration in a minute

Gate critical actions in minutes

Call Cosignet before any privileged, irreversible, or high-risk operation — from an AI agent, CLI script, CI/CD pipeline, backend service, or admin tool. No inbound webhooks, open ports, or public IP: your code polls out over its existing connection, so it works from local CLI tools and locked-down VPCs behind NAT and firewalls.

# Add the remote MCP server to Claude Code
claude mcp add --transport http cosignet https://cosignet.com/mcp \
  --header "X-Api-Key: $COSIGNET_API_KEY"

# Your agent, script, or service calls the tool before a critical action:
#   request_human_approval(action, payload, approver_username)
# and reads back approved / rejected / expired / pending.

id=$(curl -s -X POST https://cosignet.com/api/confirmations \
  -H 'content-type: application/json' -H "X-Api-Key: $COSIGNET_API_KEY" \
  --data '{"username":"alex","action":"Deploy to production",
    "payload":{"service":"api","sha":"abc123"}}' | jq -r .id)

curl -s https://cosignet.com/api/confirmations/$id -H "X-Api-Key: $COSIGNET_API_KEY"

const base = "https://cosignet.com";
const headers = { "content-type": "application/json", "X-Api-Key": process.env.COSIGNET_API_KEY! };

const { id, url } = await fetch(`${base}/api/confirmations`, {
  method: "POST", headers,
  body: JSON.stringify({
    username: "alex",
    action: "Deploy to production",
    payload: { service: "api", sha: "abc123" },
  }),
}).then((r) => r.json());

// Poll until the approver signs it.
const status = await fetch(`${base}/api/confirmations/${id}`, { headers }).then((r) => r.json());

Security & honesty

What it guarantees, and what it does not

Cosignet is not an executor or policy engine; it is an approval and evidence layer for critical actions.

Public transparency log: every approval is committed to an append-only, independently verifiable log — check any approval yourself on the verify page, with tree heads anchored into Bitcoin (OpenTimestamps). The log withholds the payload by default; you can optionally publish an approval's full action, payload, and a hash of the account's designated verified email for public proof — off unless you turn it on. See the security page for details.

Pricing

Pricing for Critical Action Control

Start free. Upgrade when Cosignet protects real production workflows.

Approvers are always unlimited, on every plan — you never pay per person who signs, and paid plans add unlimited approvals (fair use). Gate as many actions and add as many signers as you need; plan tiers vary by member capacity, retention, and features, never by approval volume. Every plan includes the full core — MCP & REST API, signature-verified webhooks, outbound polling (works behind NAT), payload-bound approvals, and the passkey audit trail with a publicly verifiable transparency log.

Members vs approvers: a member is a team seat with dashboard and API-key access — each plan sets a member limit. An approver is a passkey identity that signs approval requests; approvers are unlimited and never billed, so anyone from a solo dev to an entire on-call rotation can sign without adding cost.

• Start free in minutes — no credit card, no Docker, no agent rewrite.
• Approval volume is not the value, so we don't charge for it — control, auditability, and preventing expensive mistakes are.
• Signed decisions are bound to the exact action payload.
• Planning for outages? Read Availability and failure modes.
• Protect deploys, deletes, exports, payments, secrets, and admin operations.

Need device-bound credentials, single-tenant deployment, or a security review? Contact us.