Now in public beta. Read the announcement

One-Time Permissions for AI Agents

Secure your AI agents with scoped, ephemeral, and human-approved access to sensitive operations. Simple SDK integration, powerful policy engine, real-time approval workflow.

Get Started Free View Documentation

Free tier available

Open source SDK

5 min setup

Security First

Everything you need to secure AI agents

Built for the era of autonomous AI agents. Give your agents exactly the permissions they need, exactly when they need them.

Scoped Permissions: Define granular scopes for each operation. Limit actions to specific resources, amounts, or patterns.
Ephemeral Tokens: Tokens expire automatically after use or timeout. No persistent credentials to manage or rotate.
Human-in-the-Loop: Require approval for sensitive operations. Get notified via Telegram, email, or webhook.
Policy Engine: Configure rules to auto-approve safe operations or require human review for risky ones.
Full Audit Trail: Every permission request, approval, and usage is logged. Export logs for compliance.
Framework Agnostic: Works with LangChain, CrewAI, AutoGen, or any custom agent. TypeScript and Python SDKs.

Simple Integration

How it works

Get started in minutes. Our SDK handles the complexity so you can focus on building.

Install the SDK

Add the Agent OTP SDK to your project with npm or bun.

Request Permission

When your agent needs to perform a sensitive operation, request a one-time permission.

Approve or Auto-Approve

Based on your policies, the request is auto-approved or sent for human review.

Use the Token

Execute the operation with the scoped, ephemeral token. It expires after use.

Developer Experience

Clean, intuitive API

Our SDK is designed to be simple and predictable. Request permissions, wait for approval, use the token. That's it.

TypeScript: Full TypeScript support with complete type definitions
: Async/await with built-in timeout handling
: Detailed error messages with actionable suggestions

example.ts

import { AgentOTPClient } from '@orrisai/agent-otp-sdk';

const otp = new AgentOTPClient({
  apiKey: process.env.AGENT_OTP_KEY,
});

// Request permission for a sensitive operation
const permission = await otp.requestPermission({
  action: 'gmail.send',
  resource: 'email:client@example.com',
  scope: {
    max_emails: 1,
    subject_pattern: '^Invoice.*',
  },
  context: {
    reason: 'Sending monthly invoice',
  },
  waitForApproval: true, // Blocks until approved
});

if (permission.status === 'approved') {
  // Use the one-time token
  await sendEmail({ otpToken: permission.token });
}