Checks0
Create your account
One account for all your apps. For each app you see how often an AI agent was inside your customers' sessions, and what OneHuman did about it.
Already have an account? Sign in
One account for all your apps. For each app you see how often an AI agent was inside your customers' sessions, and what OneHuman did about it.
Already have an account? Sign in
What happened across all your apps.
Each app gets its own key. Give it to your developer — it is shown only once.
| Key | Environment | Status | Expires | Last used | Checks | Sessions with an agent |
|---|
For each app: how often an AI agent was present, which agents, what they reached for, and a live list of what happened.
Once your developer adds the key to your app, the first visit shows up here by itself.
Or test from the terminal:
The last 7 days against the 7 before, and what changed in the AI agents themselves. Written to forward to your security lead.
Choose what an AI agent may do in your app. Your app follows these rules on its own — change them here and they apply within a minute.
The assistant can only change the rules you already have. It saves nothing: you see the change first. What is sent to the AI model: your message and your rules — never your users' data.
We see these, but nothing protects them yet. Choose what should happen and add them, then save.
Start here. Everything is recorded in Activity, nobody is blocked. Turn protection on when the numbers look right.
Your app starts using the new rules within a minute. No restart, no developer needed.
Your developers — or the AI coding assistant they use — can also change the rules in the app's code. When they release that change, it arrives here by itself. You choose what happens next.
Only needed for a server that cannot reach OneHuman: start it with policyFromPortal: false and this file. Every other server reads the rules from here by itself.
Three lines on the server, one tag on the page. Pick a key and copy — or let your coding agent do the whole thing.
Runs from your own machine against your own app: it asks for a protected endpoint the way an agent would, and the decision appears above within seconds. We never send traffic to your site.
npx onehumanai verify https://app.yourcompany.com /api/balance
npm i onehumanai npx onehumanai init
init asks what to protect and how, shows every change and applies it on yes — for Express it wires the code for you. The steps below are the same thing by hand. Node ≥ 22.13.
The key is shown here only while this page is open; it is never stored in the portal after creation.
Your account, management keys and appearance.
A management key administers this account over HTTP: create and revoke project keys, read usage. Give one to your coding agent or your CI and it can set OneHuman up without anybody opening this portal. Treat it like a password — it can create keys.
Your e-mail and a scrypt hash of your password. For each key: its name, prefix, environment, expiry and a SHA-256 hash. For each decision your middleware reports: a hash of the session id, resource name, decision, actor, connection state, detected tool names and reason codes. Nothing else — no payloads, no identities, no IPs.
Copy it now — it is shown once. We only keep a hash.
Can create and revoke project keys and read usage for this account.
Copy it now — it is shown once.
Copy it now — it is shown once. The old secret already stops working; deploy this one.