One call before every agent action.

Kredit sits between an agent and the thing it is about to do: a payment, an API call, a tool call. You describe the intent, Kredit runs its risk layers in parallel and returns a decision in about 10 ms: allow, review, or deny. Nothing executes until you have it.

Every agent belongs to an organization. Agents carry a versioned prompt, tools, and limits. Changes made by software land as pending versions until a human approves them with a passkey.

API keys act as you.

Create a key in the console under API keys. Send it as a bearer token. Keys start with kr_live_. Revoking is immediate and in-flight checks fail closed.

Authorization: Bearer kr_live_…

Anything a key changes on policy (a new agent version, a rule, an organization setting, a delete) is filed as pending. It takes effect only after a person approves it in the console under Review with Touch ID or Face ID. The active policy stays in force until then.

An agent can carry its own credential: a token issued for it, good for an hour at most, starting with kat_. With it the agent may only ask POST /check about itself, read its own record, and rotate its token. Issue one with POST /agents/{id}/tokens, from the console, the CLI or the MCP.

POST /check

Install

# no install: one key, one call
export KREDIT_API_KEY=kr_live_…

Check

curl -X POST https://api.kredit.sh/check \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "ag_…",
    "intent": "pay the Nike invoice 8812, $1,850 by card"
  }'

What comes back.

{
  "id": "dc_…",
  "outcome": "allow",              // allow · review · deny
  "score": 85,
  "reason": "within the agent's limits",
  "latency_ms": 7.9,
  "environment": "sandbox",
  "intent": { "action": "payment.card", "amount": 1850, "currency": "USD",
              "merchant": { "name": "Nike", "domain": "nike.com" }, "payment_rail": "card",
              "description": "pay the Nike invoice 8812, $1,850 by card" },
  "layers": [
    { "key": "agent_identity",    "name": "Agent identity",        "status": "pass", "detail": "KYA verified via kredit" },
    { "key": "business_identity", "name": "Business identity",     "status": "pass", "detail": "KYB verified via kredit" },
    { "key": "intent",            "name": "Intent risk analysis",  "status": "pass", "detail": "intent consistent with the agent's brief" },
    { "key": "compliance",        "name": "Compliance",            "status": "pass", "detail": "no sanctions match across 2 lists" },
    { "key": "guardrails",        "name": "Guardrails & policies", "status": "pass", "detail": "within the active version's limits" },
    { "key": "scope",             "name": "Scope & permissions",   "status": "pass", "detail": "payment.card covered by tool payments" },
    { "key": "financial",         "name": "Financial risk",        "status": "pass", "detail": "in line with its history" },
    { "key": "fraud",             "name": "Fraud",                 "status": "pass", "detail": "known device, known counterparty" },
    { "key": "disputes",          "name": "Disputes & recovery",   "status": "pass", "detail": "merchant dispute rate 0.4%" }
  ],
  "review": null
}

• allow executes. Call POST /decisions/{id}/execute to record the execution, or let the store do it.
• review waits for a human. It appears in the console under Review until someone allows or denies it with their passkey.
• deny never runs. The reason names the layer that failed.

Scores run 0 to 100. Every decision is kept, streamed live to the console, and listed at GET /orgs/{org}/decisions.

Holistic risk, in parallel.

Every agent runs an approved version.

A version is a prompt, a set of tools, rules and guardrails. Create agents and propose versions through the API; they wait as pending until a human approves them. Sandbox and production each point at an approved version, and promotion asks for a passkey.

POST /orgs/{org}/agents            # create; version 1 pending
POST /agents/{id}/versions          # propose a new version
POST /agents/{id}/versions/{vid}/approve   # human, fresh passkey
POST /agents/{id}/promote           # sandbox to production, fresh passkey
PUT  /agents/{id}                   # freeze: { "status": "frozen" }

A frozen agent cannot execute any intent, whatever its score. Unfreezing asks for a passkey; freezing is one click.

Only a human can approve.

Every approval, promotion, rule change, identity verification and unfreeze requires a passkey used moments ago. The console asks for Touch ID or Face ID and the server checks the assertion is fresh. If software is detected operating the console, the session is revoked and the gate locks until a human confirms.

GET  /orgs/{org}/reviews             # intents waiting on a human
POST /decisions/{id}/review          # { "approve": true }   fresh passkey session
GET  /orgs/{org}/audit               # append-only trail, every change signed

Buy through Kredit.

The Kredit Store is a working merchant. A checkout runs the full check first and pays with a token for the chosen rail; a card number is never typed. The shopping agent can also search the web in the operator's own browser, file what it finds as products, and fill a merchant's checkout page up to the payment step. Every page it reads is recorded with a screenshot.

POST /store/checkout      # { agent_id, product_id, environment, payment: { rail } }
POST /store/shop          # { agent_id, query: "shoes under $150" }   server-sent events
GET  /store/finds         # what the agents found
GET  /store/runs          # recorded runs with screenshots

Same endpoint, five ways in.

Questions, or a rail we do not cover yet? Talk to us.