Get the app

Your answers, signed. Your keys, scoped.

An agent gets only what it needs to reach you, never a key to paste, and nothing it can approve on its own. Every answer you give comes back with a signature anyone can check.

Get the appRead about keys

No key to copy or paste.

kabu login --device prints a code. Approve it in the Kabu app, and this computer gets its own key, saved with mode 600 and never printed.

Learn how
acme-api — zsh
$ kabu login --device
In the Kabu app, open Connect a computer and enter the code: KBRT-QNWX
Or approve it in a browser: https://usekabu.com/app/connect?user_code=KBRT-QNWX
Only an admin or owner of the workspace can approve it.
{"ok": true, "org_name": "Acme", "project": "acme-api", "config_path": "/Users/you/.config/kabu/config.json"}

A key does one job.

Agent, service and admin keys carry only their own scopes. No key may both send asks and answer them, so an agent cannot approve itself.

Learn how
A key that sends asks cannot answer them (excerpt)
{"status": 403, "code": "self_response_forbidden", "detail": "A key that sends as an agent cannot speak as a human."}

Every answer is signed.

An ES256 receipt binds what was asked, the action and the answer. Check it with the public keys at /.well-known/jwks.json. A receipt holds digests, never your answer itself.

Learn how
A receipt's payload, decoded (excerpt)
{
  "v": "1",
  "iss": "https://api.usekabu.com",
  "aud": "org_01K8Y3M7Q2T9X5W1N6P4R8V3KD",
  "msg": "msg_01K8ZD6N2Q9V4T8X1M5R7W3PHC",
  "decision": "approve",
  "sub": "rcp_01K8Y4N2T7Q5W9X3M1P6R8V2JE",
  "assurance": "app",
  "via": "lock_screen",
  "req_digest": "sha256:9c1e5b7f…",
  "value_digest": "sha256:4d2a8e60…",
  "resolved_at": 1793347212
}

Encrypted at rest, per organisation.

Message content, answers, API keys and webhook secrets are sealed with AES-256-GCM under their organisation's own key.

Sensitive stays off the Lock Screen.

With --sensitive, notifications on the Lock Screen show only that Kabu needs you; the details open in the app.

Learn how

Irreversible asks need you, unlocked.

An ask marked --irreversible gets no Lock Screen buttons. You answer it in the app after Face ID, Touch ID or your passcode, and it is never settled by default.

Learn how
acme-api — zsh
$ kabu ask "Drop the staging database?" --irreversible
{"choices": ["approve"], "decision": "approve", "id": "msg_01K8ZJ8T3W6Q1X9M4P7N2R5VKC", "option": "approve", "outcome": "answered", "status": "answered", "text": null, "values": null, "via": "app"}
# exit 0: approved in the app, after Face ID

Put your agents on your phone.

One line installs the kabu CLI and connects this computer. Approve its code in the Kabu app, and your agents can tell you what they are doing, and ask.

mkdir -p ~/.local/bin && curl -fsSL https://usekabu.com/kabu -o ~/.local/bin/kabu && chmod +x ~/.local/bin/kabu && export PATH="$HOME/.local/bin:$PATH" && kabu login --device
Get the appRead the quickstart