StepAuth lets your application ask a person to approve a sensitive action before it runs it, such as wiping a laptop. Your application sends a signed request to your SplitSecure organization, an approver approves or denies it in the Web App or in Slack, and your application gets a signed decision back.
A role grants a capability. It does not prove that anyone agreed to this particular action. StepAuth adds that step: the approval covers the exact action that the approver read. A stolen session or an AI agent in your application cannot approve its own actions.
What it gives you
- Every sensitive action waits for a person who read what it does. The approval covers the exact text that the approver saw.
- The approver decides outside your application, so a stolen session, a compromised script or an AI agent cannot approve its own actions.
- Each decision is signed and tied to its request, so you can show later who approved what, and when.
- You choose who decides: one person, any member of a group, or a policy that names who must approve, in what combination.
Who does what
| Role | Who | What they do |
|---|---|---|
| Administrator | Your SplitSecure organization | Registers the application, chooses who approves, writes policies. |
| Engineer | Your application | Adds a send call and a callback endpoint with the StepAuth SDK. |
| Approver | Members of the organization | Approve or deny requests in the Web App or in Slack. |
Where to start
| You are | Read |
|---|---|
| An administrator | Configure the hub , then Write a policy . |
| An engineer | How it works , then Build a service provider . |
| An approver | Approve a request . |