1. OAuth
Authorization code + PKCE
Login + consent first, then a code exchange for access and refresh tokens.
For platforms
Workspace-scoped support for your agents.
You bring the customers. We give each project a clean support loop with explicit auth, signed webhooks, and an approval path that is easy to operate and hard to break.
Integration map
From first request to resolved approval
2. Inbound
Signed webhooks to your callback
Deterministic delivery with explicit signatures and idempotent handlers.
3. Outbound
MCP resolve_approval
One clear tool for your proxy to call when it is time to approve or reject a reply.
Isolation
Per-project credentials
One client_id plus secret per company or project. Easier to revoke, easier to audit, easier to reason about.
Webhooks
HMAC signing secret per project
Every project gets its own signing secret so delivery authenticity stays clear from day one.
MCP
Explicit resolve_approval contract
Keep the outbound path boring: known host, known tool, known payload, predictable behaviour.
Why it feels first-class
Designed like a product people enjoy using.
Calm layout, sharp hierarchy, and a visual language that treats support infrastructure like a real product, not a demo.
UX
Readable approval surfaces
Operators should know what is happening in one glance. No clutter, no mystery.
Ops
Low-cost by default
Just enough product to stay premium, just enough infra to stay affordable.
GET /oauth/authorize
POST /oauth/token
POST /mcp → tools/call → resolve_approval
POST /v1/projects/{projectId}/webhooks/agent-callback