@attesso/sdk

Authorization and safety layer for AI agent spending.

Attesso sits between users and payment processors. It doesn't touch money -- it authorizes, validates, revokes, and audits. Processors handle the payments.

npm install @attesso/sdk

How it works

1. Agent requests spending authorization -> user approves with Face ID
2. Processor validates against the mandate before charging
3. User or agent can revoke at any time -> all instruments destroyed atomically
4. Full audit trail with biometric proof for disputes

AttessoClient

import { AttessoClient } from '@attesso/sdk';

const attesso = new AttessoClient({
  apiKey: process.env.ATTESSO_API_KEY,
});

Methods

createMandateRequest(input)

Start the user approval flow. Returns an approval URL with Face ID / biometric verification.

const request = await attesso.createMandateRequest({
  externalUserId: 'user-123',
  amount: 25000,           // 250.00 in cents
  currency: 'EUR',
  validityWindow: '24h',
  callbackUrl: 'https://your-server.com/webhooks/attesso',
});
// { id, approvalUrl, expiresAt, status, callbackSecret }

getMandateRequest(requestId)

Check if the user has approved.

const status = await attesso.getMandateRequest('req_abc123');
if (status.status === 'approved') {
  console.log('Mandate active:', status.mandate.id);
  // Processor can now validate against this mandate
}

cancelMandateRequest(requestId)

await attesso.cancelMandateRequest('req_abc123');

getMandate(mandateId)

const mandate = await attesso.getMandate('mandate_xyz');
// { id, status, amount, currency }

revokeMandate(mandateId)

Revoke a mandate. All derived instruments across all processors are destroyed atomically.

await attesso.revokeMandate('mandate_xyz');
// Every card, across every processor, destroyed instantly

getDisputeEvidence(mandateId)

Get the full liability chain and audit trail. Biometric proof, developer identity, agent scope, every action logged.

const evidence = await attesso.getDisputeEvidence('mandate_xyz');
// evidence.authorization -- biometric proof (WebAuthn)
// evidence.liabilityChain -- user, developer, agent
// evidence.auditTrail -- every action logged

getRevocationEvents(mandateId)

Get the cryptographic revocation proof chain.

const { events } = await attesso.getRevocationEvents('mandate_xyz');
// events[0].revocationHash -- SHA-256 aggregate proof

Vercel AI SDK

import { generateText } from 'ai';
import { attesso } from '@attesso/sdk/vercel';

const result = await generateText({
  model: openai('gpt-4o'),
  tools: attesso.tools({ mandateId: 'mandate_xyz' }),
  prompt: 'Check my spending authorization',
});

Tools

| Tool | Description | |------|-------------| | attesso_get_mandate | Check spending limit, status, and restrictions | | attesso_revoke_mandate | Revoke mandate, destroy all instruments | | attesso_get_audit_trail | Full liability chain and audit trail |

Errors

import { AttessoError } from '@attesso/sdk';

try {
  await attesso.revokeMandate('mandate_xyz');
} catch (e) {
  if (e instanceof AttessoError) {
    console.log(e.code); // MANDATE_NOT_FOUND, etc.
  }
}

Requirements

• Node.js 18+
• For Vercel AI SDK: ai >= 3.0, zod >= 3.0

License

MIT