Getting Started

oakallow is a hosted security service for AI agent tool execution. You reach it through the REST API or the MCP connector — same governance, two surfaces.

• Checks permissions before your AI agent executes any tool
• Returns a cryptographically signed decision receipt on every check, for auditable proof
• Routes high-risk actions through human approval workflows
• Logs every permission check, approval, and execution

oakallow is not a monitoring platform or an AI agent framework. It is the security layer that sits between your agent and the tools it wants to run.

• Developers building AI agents that execute real-world actions
• Teams that need permission governance for multi-tenant AI applications
• Anyone who wants their AI to ask before it acts

Most developers are integrated within an hour. There are two integration paths and you can use either or both.

• Create an account on the web at oakallow.io. Sign-in is by passkey or email one-time code, and new accounts receive $5 in free credits.
• Enroll a passkey on your first sign-in. oakallow requires multi-factor authentication on every account.
• Save the 10 recovery codes that are generated automatically when you enroll your first passkey. Store them somewhere safe.
• Register your tools and define permission rules from the dashboard (or skip and let the MCP connector auto-discover them).

• Generate a management API key for setup, then a standard API key for runtime.
• Call the permission check endpoint before your agent acts — it returns a signed decision receipt inline — then log the result.

• Add https://api.oakallow.io/mcp as an MCP server in your client (Claude Desktop, ChatGPT, Cowork, or any MCP-compatible agent). OAuth handles auth automatically.
• Your agent calls oakallow tools by name. Unknown tools auto-register as drafts gated on requires_approval.

The dashboard includes a Quickstart guide and an API Builder that generates ready-to-run seed scripts.

Yes. oakallow has companion apps on the App Store and Google Play. The mobile apps focus on the things you need on the go: signing in with a passkey, reviewing and deciding on approval requests, viewing activity, and managing your organization's credit balance.

• Sign in with a platform passkey (Face ID, Touch ID, fingerprint, or screen lock)
• Review and approve or deny pending approval requests
• See real-time activity, organization balance, and team status
• Buy credits via Apple In-App Purchase or Google Play Billing

• Account creation. Sign up at oakallow.io on the web.
• Recovery code generation or viewing. Manage recovery codes from the web Security page.
• Configuration of tools, organizations, tenants, or permission rules. Use the web dashboard for setup.

Each mobile install is treated as its own device. The first time you sign in to the app, your passkey is verified through whatever credential authority owns it (iCloud Keychain on iOS, Google Password Manager on Android, or a hardware security key). If you have a passkey on a different device family, sign-in still works using WebAuthn cross-device flow (your phone shows a QR code that you scan with the device that holds the passkey). For everyday convenience, the app may suggest adding a passkey on the current device after your first sign-in.

• Management keys are for setup and configuration. Use them to register tools, create organizations, define tenants, and set permission rules. Management operations are free. Management keys cannot access runtime endpoints.

• Standard keys are for runtime. Your AI agent uses these to check permissions (each check returns a signed decision receipt) and log results. Runtime operations are billed at $0.005 per call.

Each key is scoped to a single organization. API keys are SHA-256 hashed at creation. The raw key is shown once and cannot be retrieved.

An Organization represents your application or project. Everything in oakallow is scoped to an organization: tools, tenants, resources, permission rules, and API keys.

If you are building a single AI agent, you will have one organization. If you are building a multi-tenant platform where each of your customers has their own AI agent, each customer can be a Tenant within your organization, with separate permission rules.

A Tenant represents one of your customers or end-users within your organization.

Tenants enable multi-tenant permission management. You can define permission rules that are scoped to a specific tenant, so Customer A might have different tool permissions than Customer B, all within the same organization.

Tenants are optional. If your AI agent serves a single team, you can skip tenants entirely and define permissions at the organization level.