Yebo Developer Documentation
Yebo: Global Authorization Infrastructure for the AI Economy. Every action your AI agent or application routes through the Yebo gateway gets a policy decision (ALLOW, DENY or REQUIRE_APPROVAL) before it runs, and every action that runs gets a gateway-signed receipt you can verify offline with the open-source npm verifier, npx yebo-verify@0.2.0. The gateway fails closed. Execution runs in dry-run mode today: no money moves.
Quick Start (Node.js / TypeScript)
Install the SDK package, @yebo-auth/sdk:
npm install @yebo-auth/sdk
Initialize the client with your gateway URL and call authorize() with the intent. It returns authorization_status and mandate_id (APPROVAL_REQUIRED when the payment needs a human approval); a denial throws GatewayError with code POLICY_DENIED. Execution runs in dry-run mode today, so no money moves.
Full SDK reference, payload shapes, and runtime examples are available to approved partners and pilot customers.
Request Sandbox Access →Getting Started
What is Yebo?
Core concepts - mandates, authorization flow, and the execution model
Quickstart - Authorize Your First Action
Authorize your first action through the gateway with the SDK (npm i @yebo-auth/sdk).
Approval Flow
How human authorization works: passkey approval of mission limits, continuation tokens
Policy
How enterprise policies are evaluated against mandates
Yebo Concepts
Mandates, authorization proofs, receipts, sessions, and integrity scores
One-Liners
Copy-paste snippets for common authorization patterns
Cheatsheet
Quick reference card for endpoints, types, and status codes
Recipes
Step-by-step guides for real-world integration scenarios
Reference
SDK Reference
Every SDK method with types and examples
API Reference
Every REST endpoint, payloads, error codes
Guides
Framework Integrations
AI agents, MCP, autonomous tools, framework integrations
Execution Adapters
Adapter configuration. Execution runs in dry-run mode today (no money moves). Live Stripe payouts, Apple Pay and ACH are coming soon.
Enterprise Deployment
Policy rules, sessions, audit export, and rollout. Webhooks are coming soon.
Security
Security model, what to keep secret, passkey approval of mission limits
How It Works
Each step must pass before the next one runs:
- 1
User Intent: Voice or text input.
- 2
Policy Decision: The policy engine returns ALLOW, DENY or REQUIRE_APPROVAL, and fails closed.
- 3
Approval: When approval is required, a human approves. For missions, your passkey approves the mission's limits (capabilities, per-transaction limit, payees). Per-payment device signing is live and has been exercised in production: the approver's passkey signs the exact payment (amount, payee, agent, validity window), and anyone can check it offline with yebo-verify 0.2.0.
- 4
Verification: Before execution the gateway re-checks the mandate: unchanged, unexpired and not replayed. Any failure blocks execution.
- 5
Execution (dry run): Execution runs in dry-run mode today: Yebo issues a signed dry-run receipt and no money moves. Live payment execution is coming soon.
- 6
Receipt: Each action that runs gets a gateway-signed receipt (ECDSA P-256, SHA-256) recording the decision.
The gateway fails closed at each step. An agent cannot approve its own mission, a continuation token works only once, and a PAI the gateway did not issue is refused.
Key Concepts
| Feature | Description |
|---|---|
| Mandate | The atomic unit of authorization. Sealed, immutable, and contains the action, scope, and governing policy. |
| Proof of Authorization | A token the gateway signs after a passkey-authenticated request. The gateway refuses any PAI it did not issue. Moving this signature onto the approver's device is coming soon. |
| Execution Receipt | A portable receipt signed by the gateway (ECDSA P-256, SHA-256), chained to the mandate. Execution is dry run today, so receipts are dry-run receipts. Public keys are published at the gateway's /authorization-receipt/keys endpoint, so anyone can verify a receipt offline with the open-source npm verifier, npx yebo-verify@0.2.0. |
| Continuation Tokens | Issued when human approval is required. Agents use these to resume after the user approves. |
| Verification | Invariant checks that run before execution: Sentinel on the /execute path, the mission gate on payment missions. Any failed check blocks the action. |
Integrity Scores
Yebo maintains a behavioral trust score (0 to 100) for every identity based on their authorization history, in four tiers: Standard (0-49), Silver (50-69), Gold (70-84) and Platinum (85-100).
- Standard
- Silver
- Gold
- Platinum
SDK Availability
- TypeScript / JavaScript: @yebo-auth/sdk 1.1.0 on npm (server-side Node.js): npm i @yebo-auth/sdk
- Python, Swift, Rust and Go: coming soon.
Security Note: Receipts are signed by the gateway, so your application does not need to hold signing keys to produce them.
Get Your API Key
API keys look like yebo_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Keep them server-side. Your dashboard issues these keys today; gateway enforcement of these keys (scopes, revocation) is coming soon.
Need Help?
- Support: support@yebo.dev
- Enterprise: enterprise@yebo.dev
- Security: security@yebo.dev