A signature behind every yes.
High-risk answers are signed on your phone after Face ID or fingerprint. The sender can check the signature before it acts.
sig MEUCIQDx…7f3aimport { verifyApproval } from "@actionfeed/sdk" const ok = await verifyApproval(response) // true if the signature matches the published key
How a signed approval works.
A key on your device
Your phone creates a P-256 key in the Secure Enclave or StrongBox. The private key is designed to stay on the device. We store only the public key.
Biometrics unlock it
The key signs only after a Face ID or fingerprint check on that device.
The sender checks it
The signature covers the message ID, the answer, the text, your account, the device and the time. If one of them changes, the check fails.
Design choices that limit risk.
Scoped tokens
Each agent and script gets its own token, limited to the feeds and permissions you chose.
Revoke any time
Pause or revoke a source from the app. Its token stops working.
Senders cannot style messages
The verified look is fixed by the app. A sender cannot make a message look like a signed approval.
Published public keys
Public keys for each device are published, so you can verify a signature without asking us.
Signed approvals add evidence to a decision. They do not make any system secure on their own. You stay responsible for what your scripts and agents do with an answer. See the terms of service.