Skip to main content

How approval works

When a card requires approval, it’s created with status: pending_approval. No virtual card is issued and no payment hold is placed until the card is approved.

Triggering approval

  1. Explicit: Set require_approval: true in the card creation request
  2. Rules-based: Configure approval rules that automatically trigger based on amount, currency, merchant, or agent type
  3. Delegation: Delegation rules can force approval even when rules say auto-approve

Approval channels

  • Telegram — tap Approve/Deny directly from the notification
  • Slack — card requests posted in-channel for team visibility
  • Web — mobile-optimized approval page with CSRF protection

Approval rules

Create rules via POST /v1/approval-rules:
Rules are evaluated by priority (highest first). Types: auto_approve, require_approval, deny.

Security

  • Approval tokens are SHA-256 hashed and stored (raw token sent via notification)
  • Tokens expire after 30 minutes
  • One-time use — cannot be replayed
  • CSRF protection on the approval page (token in POST body)