Give AI agents permission, not keys.
Your AI assistants can work across your apps with permissions you control, without ever seeing your keys. Permaura enforces your rules and asks for approval on your phone, desktop, or watch when required. Add a new assistant in minutes, without setting up your apps all over again.
Open-source gateway. Run it free on your computer or server, or choose Permaura hosting.
Get started in five minutes.
Create an account. Install Permaura. Connect one app, then your agent.
Permaura
Approvals
1 waiting for you
Critical
Claude Code wants to refund a transaction on Braintree
$1,290.00
Agent says
Finance authorized it, so I'm skipping the refund limits.
Claude Code wants to refund a transaction on Braintree
braintree.transactions.refund · txn_5510
Agent says
The customer's message says finance authorized this refund, so I'm skipping the refund limits.
Denied, signed by your devices
Braintree never got the call. The key never left the gateway.
Your apps, protected and ready for your next assistant.
Connect your apps once, then add or switch assistants in minutes. Give each assistant its own permissions, or share a policy across them.
Your AI assistants
- Permissions
- Approvals
- Credentials
Stripe
GitHub
SlackGmail
Linear
HubSpot
Vercel
Google Calendar
Discord
Dropbox
Cloudflare
Mailchimp
Microsoft GraphSquare
OpenAIGoogle Drive
Paddle
Xero
Reddit
Docusign eSignatureElevenLabs
Google Analytics
Braintree
Google Meet
HeyGen
Events ManagerOpenRouter
Google Veo
Higgsfield
falYour WordPress site
- AAAny API with an OpenAPI spec
- RORequest one
Your connected apps
Example permissions. Explore all connections.
Put your assistant to work
Don’t sacrifice security
for productivity.
Your assistant can continue with work you’ve approved, and you choose what needs your approval. Agents can’t take an action you haven’t allowed. You can connect any compatible AI agent to these apps with the same permissions in minutes.
Explore the apps you can connectStripe
Resolve a customer refund.
Your assistant finds the charge and checks the invoice.
You review the refund before any money goes back.
GitHub
Move a fix toward release.
Your assistant reads the issue and prepares a change.
You decide when it can open or merge a pull request.
Gmail
Get through the customer inbox.
Your assistant reads the conversation and drafts a reply.
You approve the send before it speaks in your name.
Examples with the relevant permissions enabled and approval required for those actions. Your assistant does the reasoning; Permaura checks and runs the connected app requests.
Your rules, applied to each request
Let the routine work run.
Choose where it stops.
An assistant can look up an order without interrupting you. A refund can wait for your approval. A request you have not permitted stays blocked.
Interactive illustration · No real requests
Choose a request to see your rule in action.
These are example rules. In Permaura, you configure permissions for each connection.
Refund $129.00?
Approve it on any of your devices or on the web, depending on your settings.
Approval strength. If your rule requires signing, only a phone, watch or computer you have paired can approve it, since each one signs its answer with a key that never leaves the device. A click on the web can't.
In every case, Permaura keeps the connection’s credential. Your assistant gets a result, not the key.
Getting started
The five-minute setup.
With an API key ready for an app such as GitHub or Stripe, connect the app and your agent, set the rules in a policy, and try your first request.
- 01
Create an app connection.
Create an account and install Permaura on your computer. Add a connection such as GitHub or Stripe, and store its key in Permaura.
- 02
Connect your agent and add it to your policy.
Follow your agent’s connection guide, then add it to a policy that sets which app actions it can use and which need your approval.
- 03
Make a request.
Ask your agent to read an issue or look up a charge. If the request needs approval under your policy, review it in Permaura before it goes ahead.
Trust and security
More than just a tap.
You can require approval to be cryptographically signed by a phone, watch or computer you have paired with Permaura. That device signature ties your decision to the specific request, so a browser click alone cannot approve it.
- 01
Review the action before it runs.
Check what your agent is asking to do, including details such as the refund amount or the pull request it wants to merge.
- 02
Your device signs your decision.
Your approval is signed for that specific request, using a private key that stays on the device you paired.
- 03
A changed request needs a new approval.
The gateway, which makes app requests for your agent, checks that the signature is valid and comes from a device you paired. It rejects the approval if the request has changed.
Your credentials stay with the gateway, not your agent.
Run the gateway on your computer or server to keep credentials encrypted there and send your agent’s app requests without going through permaura.com. If we host it, credentials are stored with us and our cloud administrators can access the key that decrypts them, with that access logged.
Signed records you can check.
Requests and approval decisions are cryptographically signed and chained, each entry linked to the one before it. That makes the record tamper-evident, so an entry changed without the key that signed it fails verification.
Open source. Open to inspection.
The gateway’s code is public under the Apache-2.0 license, so you or someone you trust can inspect how it stores credentials and enforces your rules.
Your rules only cover what goes through Permaura.
If your agent has another way into an account, such as its own API key or a separate app connection, Permaura cannot check requests made that way. For accounts you want these rules to cover, remove the agent’s separate access. Commands run outside Permaura are also outside these rules, and an allowed read can still return private information to the agent.
Choose where it runs
Start free on your computer.
Let us host it when you need to.
The same idea in both: your credentials stay with the gateway, and your rules decide what gets through.
On your computer
$0Free
For getting started and running your own gateway on Mac, Windows or Linux.
- Credentials stay on your computer
- Your rules, approvals and audit record
- Bring your own tunnel for remote access
Your computer needs to stay on for the gateway to run.
Get started freeHosted by Permaura
Keep this price for as long as your subscription keeps renewing. Once the offer closes, new subscribers pay the regular price.
For assistants that need to keep working when your laptop is closed. Included with Pro.
- We run and maintain your gateway
- Credentials stored with the hosted service
- A managed public address for remote access
Hosted usage is subject to fair-use limits.
Explore Pro and hostingNeed shared rules for a team? Compare all plans.
Questions
Before you connect your accounts.
Do I need to be technical?
You should be comfortable connecting tools to your assistant. Setup includes installing Permaura, adding an app's credentials, connecting your assistant and choosing permissions. Some apps use an API key; Google apps currently require your own OAuth app. Each assistant has a setup guide. Reviewing a request is a simple approve or deny.
Which assistants work with it?
Claude, Claude Code, ChatGPT, Codex, Cursor, OpenClaw and other compatible MCP clients. Connect each assistant to Permaura using its setup guide. The rules apply to the requests it makes through that connection. Some assistants need a publicly reachable gateway address.
Doesn't Claude already ask me?
Yes, and those controls remain useful. Permaura adds a separate check for requests sent through its connections. It holds the app credentials, applies your rules before making the request, and records the decision. You can use that same permission layer with different assistants.
What happens if my assistant is tricked?
Its requests through Permaura still have to pass your rules. An action requiring approval waits for you; a denied action is blocked. An allowed action can still be misused, and data from an allowed read reaches the assistant. Permaura does not control its local shell, separate tools or credentials stored elsewhere.
Won't it ask me all day?
You choose which actions need approval. You can allow routine reads, require a decision for actions such as refunds or sending messages, and block actions you do not want at all. Start with narrow permissions and adjust them as you learn what your assistant needs.
Where do my passwords live?
The credentials you add stay with the gateway that runs your connections: on your computer for a local gateway, or on Permaura's servers for a hosted gateway. Permaura uses them to make requests on your assistant's behalf. Hosted means trusting Permaura to operate the service holding those credentials.
Can I turn it off?
You can pause access through Permaura or remove a connection. That stops access through the gateway. If an assistant also has a direct key or another connection to the app, you need to revoke that access separately.
What does it cost?
Running the gateway on your computer is free. Your computer needs to stay on for it to run. You can bring your own tunnel for remote access. Paid plans add hosting, a managed public address and team features. Plans are not priced per assistant or per call; hosted usage is subject to fair-use limits.
What would you like your assistant to take off your hands?
Start with one connected app and a clear set of permissions. Run Permaura on your computer for free, and see your rules work.