Skip to main content
This is the shortest complete server-side integration path, running on the free test environment. Use the test API at https://api-staging.attesso.com with an att_test_ key. The live environment at https://api.attesso.com requires att_live_ keys, which are enabled only after linking Stripe Billing.

​
Run it end to end

One command goes from a test key to verified evidence on your own machine: it creates the Mandate, approves it in the browser with a passkey, shows one over-cap attempt refused, commits one in-cap action, and verifies the signed evidence locally. Node.js 20+, no dependencies.
First run: paste your att_test_ key once; the script provisions the workspace’s test approval trust. Later runs are zero-config.
Never expose an Attesso API key to a browser, end user, or agent.

​
The five calls, if you assemble it yourself

  1. POST /v1/mandates: create the Mandate (PENDING_APPROVAL) with its policy, window, and approval deadline.
  2. POST /v1/mandates/{id}/approval-sessions: sign a short-lived identity assertion and create the hosted approval session; send the browser to the returned approval_url, then read the Mandate server-to-server until it is ACTIVE. Claims and signing examples: Hosted approval.
  3. POST /v1/mandates/{id}/authorizations: authorize the concrete action with a single-use commitment (the SHA-256 of the domain line attesso:authorization:commitment:v1 plus a random 32-byte opening you keep); continue only when can_execute is exactly true.
  4. PUT /v1/authorizations/{id}/commit: after your executor accepts the action, revealing the opening; the Authorization becomes COMMITTED and the Mandate CONSUMED.
  5. GET /v1/mandates/{id}/evidence: fetch the signed bundle and verify it (Verify evidence).
Use one idempotency key per logical write; reuse it only when retrying the same operation with the same input.