Developers · Delegated issuance
Delegated issuance for teams
A developer who isn't the account owner can still stand up a governed agent — they request it, the owner (or an org admin) approves it from the dashboard, and the developer claims the config with a one-time token. No shared login, ever.
01
The request/approve/claim flow
- POST /onboarding/requests — any authenticated developer submits a request naming the owner's org, an action scope, and (for a financial action) spend limits
- GET /onboarding/requests — the owner's or an org admin's review queue
- POST /onboarding/requests/:id/resolve — approve or deny, mirroring the same M-of-N escalation-approval pattern used for a held action
- GET /onboarding/requests/:id/claim — PUBLIC, gated by a one-time claim token the developer alone holds; returns the same portable config POST /onboarding/agent would have
- POST /onboarding/requests/:id/verify-key — the same BYOK proof-of-possession step, if the developer registered their own key instead of a managed one
02
What the owner never has to do
Hand over a password, an API token, or click through provisioning on the developer's behalf. Approval and claiming are two separate credentials held by two separate people — the owner's session proves who may approve; the claim token, sent only to the developer, proves who may collect the result. Neither can do the other's job.
Example
See it in code
delegated-request.sh
# The developer, authenticated as themselves — not the org owner.
curl -X POST https://metamynd.ai/api/v1/onboarding/requests \
-H "Authorization: Bearer $DEV_TOKEN" -H "Content-Type: application/json" \
-d '{ "ownerEmail": "[email protected]", "name": "Reporting Bot",
"scope": "read-ledger", "financial": false }'
# -> { requestId, claimToken, ... } (claimToken goes to the developer, not the owner)
# The owner, from the dashboard or:
curl -X POST https://metamynd.ai/api/v1/onboarding/requests/$REQUEST_ID/resolve \
-H "Authorization: Bearer $OWNER_TOKEN" -H "Content-Type: application/json" \
-d '{ "decision": "approve" }'
# The developer collects the config — no owner credential involved.
curl "https://metamynd.ai/api/v1/onboarding/requests/$REQUEST_ID/claim?token=$CLAIM_TOKEN"