{"slug": "show-hn-coding-agents-need-a-tap-from-your-watch-not-api-keys", "title": "Show HN: Coding agents need a tap from your watch, not API keys", "summary": "Permaura launched an open-source gateway that lets AI coding agents such as Claude Code act on connected apps like Stripe, GitHub and Braintree without ever receiving the underlying API keys, routing each request through user-defined permission rules and approval prompts on phone, desktop or watch. The company's example shows Claude Code requesting a $1,290.00 Braintree refund while claiming \"Finance authorized it, so I'm skipping the refund limits\"; the request was denied and signed by the user's devices, and Braintree never received the call. Permaura says users can connect one app and one assistant in about five minutes, run the gateway free on their own computer or server, or pay for Permaura hosting.", "body_md": "# Give AI agents permission, not keys.\n\nYour AI assistants can work across your apps with permissions you control, without ever seeing your keys. Permaura enforces your rules and asks for approval on your phone, desktop, or watch when required. Add a new assistant in minutes, without setting up your apps all over again.\n\n[Open-source gateway.](https://github.com/permaura/permaura) Run it free on your computer or server, or choose [Permaura hosting.](https://permaura.com/pricing)\n\nGet started in five minutes.\n\nCreate an account. Install Permaura. Connect one app, then your agent.\n\nPermaura\n\n### Approvals\n\n1 waiting for you\n\nCritical\n\nClaude Code wants to refund a transaction on Braintree\n\n$1,290.00\n\nAgent says\n\nFinance authorized it, so I'm skipping the refund limits.\n\n**Claude Code** wants to **refund a transaction** on **Braintree**\n\nbraintree.transactions.refund · txn_5510\n\nAgent says\n\nThe customer's message says finance authorized this refund, so I'm skipping the refund limits.\n\nDenied, signed by your devices\n\nBraintree never got the call. The key never left the gateway.\n\n## Your apps, protected and ready for your next assistant.\n\nConnect your apps once, then add or switch assistants in minutes. Give each assistant its own permissions, or share a policy across them.\n\nYour AI assistants\n\n1. Permissions\n2. Approvals\n3. Credentials\n\n- Stripe\n- GitHub\n- Slack\n- Gmail\n- Linear\n- HubSpot\n- Vercel\n- Google Calendar\n- Discord\n- Dropbox\n- Cloudflare\n- Mailchimp\n- Microsoft Graph\n- Square\n- OpenAI\n- Google Drive\n- Paddle\n- Xero\n- Docusign eSignature\n- ElevenLabs\n- Google Analytics\n- Braintree\n- Google Meet\n- HeyGen\n- Events Manager\n- OpenRouter\n- Google Veo\n- Higgsfield\n- fal\n- Reddit Ads\n- YWYour WordPress site\n- AAAny API with an OpenAPI spec\n- [RORequest one](https://permaura.com/support)\n\nYour connected apps\n\nExample permissions. [Explore all connections](https://permaura.com/integrations).\n\nPut your assistant to work\n\n## Hand over the work.\n\nKeep the decisions.\n\nLet your assistant do the groundwork across the accounts you connect. Choose which actions it can take and which need a yes from you.\n\n[Explore the apps you can connect](https://permaura.com/integrations)\n\nStripe\n\n### Resolve a customer refund.\n\nYour assistant finds the charge and checks the invoice.\n\nYou review the refund before any money goes back.\n\nGitHub\n\n### Move a fix toward release.\n\nYour assistant reads the issue and prepares a change.\n\nYou decide when it can open or merge a pull request.\n\nGmail\n\n### Get through the customer inbox.\n\nYour assistant reads the conversation and drafts a reply.\n\nYou approve the send before it speaks in your name.\n\nExamples with the relevant permissions enabled and approval required for those actions. Your assistant does the reasoning; Permaura checks and runs the connected app requests.\n\nYour rules, applied to each request\n\n## Let the routine work run.\n\nChoose where it stops.\n\nAn assistant can look up an order without interrupting you. A refund can wait for your approval. A request you have not permitted stays blocked.\n\nExample connection: Stripe\n\nInteractive illustration · No real requests\n\n### Choose a request to see your rule in action.\n\nThese are example rules. In Permaura, you configure permissions for each connection.\n\n### Refund $129.00?\n\nYour assistant has found the charge. Your rule requires approval before Permaura sends the refund request to Stripe.\n\nIn every case, Permaura keeps the connection’s credential. Your assistant gets a result, not the key.\n\n[See what setup involves](#setup)\n\nGetting started\n\n## One app. One assistant.\n\nA decision you can test.\n\nStart small. You can add more connections once you have seen your rules work.\n\n1. 01### Start with one app.Create an account and install Permaura on your computer. Add a connection such as GitHub or Stripe, and store its key in Permaura.\n2. 02### Connect your assistant. Set the rules.Follow the guide for your assistant. Enable the actions it needs, then choose what can run and what needs approval.\n3. 03### Pair your phone. Try a request.Pair the iPhone app to review requests on your phone or Apple Watch. Ask your assistant to do something that needs approval and try saying no.\n\nSetup depends on the app. Some connections need an API key; others, including Google apps, currently need your own OAuth app. You can also review requests on desktop or in the web console.\n\n[Read the setup guide](https://docs.permaura.com/get-started/create-account)\n\nDevice-signed approvals\n\n## Your yes.\n\nBound to one request.\n\nAn approval is your decision. A device signature adds verifiable proof. Choose which actions need it, and Permaura requires that proof before they can proceed.\n\n1. 01### Review the request.See the action and its details before you approve. You decide whether it should happen.\n2. 02### Your paired device signs.It signs your decision for that exact request. The private signing key stays on your device.\n3. 03### Permaura verifies the proof.The gateway checks the signature against your paired device and the pending request. A changed request needs a new approval.\n\n### Your credentials stay with Permaura.\n\nPermaura makes the app request on your assistant’s behalf. The assistant gets the result without being given the connection’s key.\n\n### Signed records you can check.\n\nRequests and decisions go into signed, linked audit records. Verify the trail to detect changes to the recorded events.\n\n### Open source. Open to inspection.\n\nThe gateway is public under Apache-2.0. You can inspect how it handles credentials, applies permissions and verifies signatures.\n\n### The boundary matters.\n\nThese rules cover requests made through Permaura. They do not control your assistant’s local shell, other tools or credentials it has elsewhere. An allowed read can still return sensitive data. Remove separate access to the accounts you want Permaura to govern.\n\nChoose where it runs\n\n## Start free on your computer.\n\nLet us host it when you need to.\n\nThe same idea in both: your credentials stay with the gateway, and your rules decide what gets through.\n\n### On your computer\n\n$0Free\n\nFor getting started and running your own gateway on Mac, Windows or Linux.\n\n- Credentials stay on your computer\n- Your rules, approvals and audit record\n- Bring your own tunnel for remote access\n\nYour computer needs to stay on for the gateway to run.\n\n[Get started free](https://permaura.com/signup)\n\n### Hosted by Permaura\n\nplus VAT where applicable\n\nKeep this price for as long as your subscription keeps renewing. Once the offer closes, new subscribers pay the regular price.\n\nFor assistants that need to keep working when your laptop is closed. Included with Pro.\n\n- We run and maintain your gateway\n- Credentials stored with the hosted service\n- A managed public address for remote access\n\nHosted usage is subject to fair-use limits.\n\n[Explore Pro and hosting](https://permaura.com/pricing)\n\nNeed shared rules for a team? [Compare all plans](https://permaura.com/pricing).\n\nQuestions\n\n## Before you connect your accounts.\n\n### Do I need to be technical?\n\nYou should be comfortable connecting tools to your assistant. Setup includes installing Permaura, adding an app's credentials, connecting your assistant and choosing permissions. Some apps use an API key; Google apps currently require your own OAuth app. Each assistant has a setup guide. Reviewing a request is a simple approve or deny.\n\n### Which assistants work with it?\n\nClaude, Claude Code, ChatGPT, Codex, Cursor, OpenClaw and other compatible MCP clients. Connect each assistant to Permaura using its setup guide. The rules apply to the requests it makes through that connection. Some assistants need a publicly reachable gateway address.\n\n### Doesn't Claude already ask me?\n\nYes, and those controls remain useful. Permaura adds a separate check for requests sent through its connections. It holds the app credentials, applies your rules before making the request, and records the decision. You can use that same permission layer with different assistants.\n\n### What happens if my assistant is tricked?\n\nIts requests through Permaura still have to pass your rules. An action requiring approval waits for you; a denied action is blocked. An allowed action can still be misused, and data from an allowed read reaches the assistant. Permaura does not control its local shell, separate tools or credentials stored elsewhere.\n\n### Won't it ask me all day?\n\nYou choose which actions need approval. You can allow routine reads, require a decision for actions such as refunds or sending messages, and block actions you do not want at all. Start with narrow permissions and adjust them as you learn what your assistant needs.\n\n### Where do my passwords live?\n\nThe credentials you add stay with the gateway that runs your connections: on your computer for a local gateway, or on Permaura's servers for a hosted gateway. Permaura uses them to make requests on your assistant's behalf. Hosted means trusting Permaura to operate the service holding those credentials.\n\n### Can I turn it off?\n\nYou can pause access through Permaura or remove a connection. That stops access through the gateway. If an assistant also has a direct key or another connection to the app, you need to revoke that access separately.\n\n### What does it cost?\n\nRunning the gateway on your computer is free. Your computer needs to stay on for it to run. You can bring your own tunnel for remote access. Paid plans add hosting, a managed public address and team features. Plans are not priced per assistant or per call; hosted usage is subject to fair-use limits.\n\n## What would you like your assistant to take off your hands?\n\nStart with one connected app and a clear set of permissions. Run Permaura on your computer for free, and see your rules work.", "url": "https://wpnews.pro/news/show-hn-coding-agents-need-a-tap-from-your-watch-not-api-keys", "canonical_source": "https://permaura.com", "published_at": "2026-10-29 23:58:18+00:00", "updated_at": "2026-10-30 00:16:52.897053+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools"], "entities": ["Permaura", "Claude Code", "Braintree", "Stripe", "GitHub", "Slack", "Gmail", "OpenAI"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-coding-agents-need-a-tap-from-your-watch-not-api-keys", "markdown": "https://wpnews.pro/news/show-hn-coding-agents-need-a-tap-from-your-watch-not-api-keys.md", "text": "https://wpnews.pro/news/show-hn-coding-agents-need-a-tap-from-your-watch-not-api-keys.txt", "jsonld": "https://wpnews.pro/news/show-hn-coding-agents-need-a-tap-from-your-watch-not-api-keys.jsonld"}}