Quickstart · Delegus Docs

Signup to first signed receipt: under a minute.

Go to app.delegus.ai, enter your Work email and choose Email me a link. There is no password.
Open the email ("Sign in to the Delegus console"). The link works for 15 minutes. It opens a page that asks you to confirm; choose Sign me in.
Name your organization and choose Create organization. You become its first admin.

2. Copy your verify key#

The next screen, "your organization is ready", shows a verify key for your server. It starts with dk_rp_.

It is shown once. Choose Copy verify key and store it in a secret manager. It cannot be retrieved later; if you lose it, mint a new one from Keys in the console.
It lets your server call /verify for your organization. It cannot administer the organization.

Put it in your server's environment, never in your code:

bash

export DELEGUS_API_KEY=dk_rp_...

3. Send the sample request#

Open Getting started in the console (app.delegus.ai/getting-started). It shows a sample Grant and Proof you can use straight away. The sample Grant lasts one hour and each sample Proof five minutes; reload the page for fresh ones. If you would rather not run anything yet, choose See my first receipt and the console sends the request for you.

With curl, paste the sample Grant and Proof in place of the placeholders:

bash

curl -s https://api.delegus.ai/verify \
  -H "authorization: Bearer $DELEGUS_API_KEY" \
  -H "content-type: application/json" \
  -d '{"grant":"<JWS>","proof":"<JWS>","action":{"type":"commerce:purchase","resource":"sandbox/quickstart","amount":1000,"currency":"USD"}}'

amount is in minor units, so 1000 is $10.00.

Or with the SDK (npm install @delegus/sdk):

import { Delegus } from "@delegus/sdk";

const delegus = new Delegus({ apiKey: process.env.DELEGUS_API_KEY });
const d = await delegus.verify({ grant, proof, action });
console.log(d.decision); // "ALLOW" — d.receipt is the signed receipt to keep

4. Your first signed ALLOW#

The answer is HTTP 200 with the decision and a signed receipt:

json

{
  "decision": "ALLOW",
  "reason": null,
  "receipt_id": "drc_...",
  "receipt": "eyJ... (a signed compact JWS)"
}

That is a trimmed view; the full response is in the API reference. Keep receipt. It records who authorized the action, under which Grant, and what Delegus decided, and anyone can re-check it offline later without calling Delegus. A refusal comes back the same way: "decision": "DENY" with a reason code and its own signed receipt. Every reason code is in DENY reason codes.

Free to start#

The sandbox is free, with no card, and uses test permissions only. When you go live, you add a card and the first 14 days in production are free; on day 15 you move to Starter at $99 a month unless you cancel. The console's Usage page shows how many you have used this month. Paid plans are on the pricing page.

Next#

Integrate as a relying party: check real requests from agents before you act on them.
SDK and CLI: the full @delegus/sdk surface.
MCP servers: add the check to an MCP server in one line.
Receipts and offline verification: what a receipt proves and how to re-check it.