Official package · Realtime building blocks

Human approvals for AI agents

When an agent wants to run a tool that needs a person’s OK, the call waits in a live inbox. Reviewers approve, edit or reject it, see who else is looking, and the agent carries on where it stopped.

@hibira-io/approvalsnpm ↗GitHub ↗PyPI ↗

• Server helpers for the Vercel AI SDK, Mastra and LangGraph, and a Python package for LangGraph and FastAPI.
• React and Vue inbox components in seven languages, in light and dark.
• One protocol shared with Filament AI approvals and the MCP server’s request_approval tool, so one inbox can show requests from all of them.

Sign in to see these snippets with your own cluster host. Sign in

1. Install

   npm install @hibira-io/approvals pusher pusher-js

2. Set it up

   import Pusher from 'pusher';
   import { createApprovals } from '@hibira-io/approvals';
   
   const pusher = new Pusher({
     appId: process.env.HIBIRA_APP_ID,
     key: process.env.HIBIRA_KEY,
     secret: process.env.HIBIRA_SECRET,
     host: 'ws.hibira.io',
     useTLS: true,
   });
   
   export const approvals = createApprovals({
     pusher,
     scope: 'support',
     resume: async (request) => continueAgent(request), // give the agent its answers
   });

3. Use it

   import { ApprovalInbox, createApprovalsClient } from '@hibira-io/approvals/react';
   import '@hibira-io/approvals/styles.css';
   
   const client = createApprovalsClient({ endpoint: '/api/approvals', pusher, scope: 'support' });
   
   export function ApprovalsPage({ me }) {
     return <ApprovalInbox client={client} me={me.id} />;
   }

Before you start

• The app secret is shown only once, when you create the app or rotate its secret. Keep it on your server, never in a browser or game build.
• approvals.handler() serves the inbox’s routes and the channel authorization. Decisions go from the inbox to your backend, never through client events.
• Requests live in memory by default. In production, pass a store over your own database.

Use the app key from your dashboard; the secret stays on your server. Channels, events and authorization endpoints work exactly as they do with Pusher. Create your free account →