Control critical actions before they execute.

Live demo

Try a critical-action approval

Create a real approval request bound to a demo payload {"action":"demo","amount":"$0"}. Review the exact action, approve it with your device passkey, and see the signed decision returned to the system. The same routes power production.

What to gate

Actions that should not run silently

Put an explicit approval in front of the irreversible, costly, or externally-visible calls your automation, agents, and services make.

• Payment Refunds, payouts, invoices, plan changes
• Production Deploys, config changes, database writes
• Destructive Delete or export data, drop resources, rotate secrets
• External Customer emails, Slack posts, support replies
• Admin API MCP tools, user deletion, permission changes, billing
• Code Merge a high-risk PR, trigger a release

Who it's for

One gate, three jobs

How it works

Three steps, one binding

Critical action → passkey approval → signed decision → audit trail

1. 1. Your system requests approval

   An MCP tool call or a single HTTP request — from your agent, script, CI/CD pipeline, or backend service — carries the exact action payload.

   // MCP tool: request_human_approval
   {
     "action": "Wire transfer to vendor",
     "payload": { "to": "acct_8821", "amount_usd": 4200, "memo": "INV-2025-118" },
     "approver_username": "alex"
   }

   curl -X POST https://cosignet.com/api/confirmations \
     -H 'content-type: application/json' \
     -H 'X-Api-Key: $COSIGNET_API_KEY' \
     --data '{"username":"alex","action":"Wire transfer to vendor",
       "payload":{"to":"acct_8821","amount_usd":4200,"memo":"INV-2025-118"}}'

2. 2. The approver reviews the exact action

   The approver opens the link and sees a clear, field-by-field breakdown of the exact action — not raw code — then signs it with a passkey. User verification is required. Every field of the signed payload is shown, and the raw payload plus its SHA-256 are one tap away for verification.

   Action:      Wire transfer to vendor
   To:          acct_8821
   Amount Usd:  4200
   Memo:        INV-2025-118
   sha-256:     9f2c…a17b   ← the exact data being signed

   Challenge = nonce ‖ SHA-256(payload). What the approver saw is what got signed.

3. 3. Cosignet returns a signed decision

   The status flips to approved with the raw WebAuthn assertion stored as proof. The assertion is bound to the challenge, so it cannot be replayed against a different payload.

   GET /api/confirmations/{id}
   {
     "status": "approved",
     "payloadHash": "9f2c…a17b",
     "credentialId": "…",
     "rawAssertion": { "response": { "clientDataJSON": "…", "signature": "…" } }
   }

Why not just ask in Slack?

A confirmation says “yes”. Cosignet signs what was approved.

A Slack button, a confirmation modal, or a workflow tool records that someone clicked — there's no cryptographic proof a specific human approved a specific operation, and prompt injection can talk an agent past a soft "yes". None of them bind that click to the exact action: if the agent changes the recipient, amount, endpoint, or command after the click, nothing breaks.

Cosignet's signature covers nonce ‖ SHA-256(payload). Change any field after approval and the signed decision no longer matches — so the approval is evidence about a specific operation, not just UI reassurance. It complements IAM and audit logs; it does not replace them.

Integration in a minute

Gate critical actions in minutes

Call Cosignet before any privileged, irreversible, or high-risk operation — from an AI agent, CLI script, CI/CD pipeline, backend service, or admin tool. No inbound webhooks, open ports, or public IP: your code polls out over its existing connection, so it works from local CLI tools and locked-down VPCs behind NAT and firewalls.

# Add the remote MCP server to Claude Code
claude mcp add --transport http cosignet https://cosignet.com/mcp \
  --header "X-Api-Key: $COSIGNET_API_KEY"

# Your agent, script, or service calls the tool before a critical action:
#   request_human_approval(action, payload, approver_username)
# and reads back approved / rejected / expired / pending.

id=$(curl -s -X POST https://cosignet.com/api/confirmations \
  -H 'content-type: application/json' -H "X-Api-Key: $COSIGNET_API_KEY" \
  --data '{"username":"alex","action":"Deploy to production",
    "payload":{"service":"api","sha":"abc123"}}' | jq -r .id)

curl -s https://cosignet.com/api/confirmations/$id -H "X-Api-Key: $COSIGNET_API_KEY"

const base = "https://cosignet.com";
const headers = { "content-type": "application/json", "X-Api-Key": process.env.COSIGNET_API_KEY! };

const { id, url } = await fetch(`${base}/api/confirmations`, {
  method: "POST", headers,
  body: JSON.stringify({
    username: "alex",
    action: "Deploy to production",
    payload: { service: "api", sha: "abc123" },
  }),
}).then((r) => r.json());

// Poll until the approver signs it.
const status = await fetch(`${base}/api/confirmations/${id}`, { headers }).then((r) => r.json());

Security & honesty

What it guarantees, and what it does not

Cosignet is not an executor or policy engine; it is an approval and evidence layer for critical actions.

Public transparency log: every approval is committed to an append-only, independently verifiable log — check any approval yourself on the verify page, with tree heads anchored into Bitcoin (OpenTimestamps). The log withholds the payload by default; you can optionally publish an approval's full action, payload, and a hash of the approver's verified email for public proof — off unless you turn it on. See the security page for details.

Pricing

Pricing for Critical Action Control

Start free. Upgrade when Cosignet protects real production workflows.

Every plan includes the full core — MCP & REST API, signature-verified webhooks, outbound polling (works behind NAT), payload-bound approvals, and the passkey audit trail with a publicly verifiable transparency log. Approvers are always unlimited — you never pay per person who signs.

• No credit card for Free. No Docker. No agent rewrite.
• Approval volume is not the value — control, auditability, and preventing expensive mistakes are.
• Signed decisions are bound to the exact action payload.
• Protect deploys, deletes, exports, payments, secrets, and admin operations.

Need higher limits or device-bound credentials? Contact us.