AffixIO logoAffixIO

Connections

Every way in, on one page.

SDKs, API, MCP, webhooks, export, Hub, edge. A governance page so large teams do not invent a fourteenth door.

Sign In See it live

Pick by what you are building

Most teams land on one client and one event path. The client proves or verifies. The event path tells the rest of the stack that something happened. Everything else on this page is optional.

You run Node and need a real ZK proof

Install affixio. Local UltraHonk prove, then sync for ML-DSA-65 attestation and Merkle anchoring.

You run Node and need milliseconds

Install @affix-io/sdk-light. HMAC Light prove and local verify. Light is not zero knowledge.

You run Python, Go, Java or anything else

Call the HTTP API. The Python page has a working client, webhook checks and Merkle inclusion in the standard library.

Clients

Four places a host can speak from. Two are published packages. Two are contracts you implement against the API.

Node

affixio

UltraHonk zero-knowledge prove over Noir circuits, ML-DSA-65 sync, Merkle audit, carriers and offline queue. Apache-2.0 on npm, Node 18+.

Package · 1.1.1

Node

@affix-io/sdk-light

Millisecond HMAC Light prove and verifyLocal. Same sync and audit surfaces. Light proofs are not SNARKs.

Package · 1.1.3

Python

HTTP client, no PyPI package

There is nothing on PyPI. A forty-line client, webhook signature checks with hmac, and Merkle inclusion with hashlib.

Contract · standard library

Browser

No WASM prover

No browser package. Keep the key on a server you control. Light is not ZK. Public Merkle root and public key are readable without a key.

Pattern · backend verify

API and agents

The contract everything else hangs off, and the two ways an agent reaches it.

HTTP

api.affix-io.com

Base URL, authentication, rate limits, OpenAPI schema. Prefer direct calls for production throughput.

OpenAPI · /v1/openapi.json

MCP

Remote MCP server

Streamable HTTP with OAuth 2.1 and PKCE. Tools affix_api_read and affix_api_write, resource affix-openapi.

Connect · /mcp/

Agents

For agents

How to gate tool execution on a verify outcome without putting end-user data into a chat context.

Reference · agent readiness

Events and evidence

Two different answers to the same question. Webhooks for latency. The export for completeness.

Push

Signed webhooks

Five events, HMAC-SHA256 over {timestamp}.{raw_body}, a five minute replay window and three attempts. Manage endpoints at Hub.

Manage · hub.affix-io.com/webhooks/

Pull

SIEM and evidence export

Newline-delimited JSON of every event AffixIO holds for your keys. Ten thousand per request, JSON variant for auditors.

GET · /api/export/siem

Edge, infrastructure and access

Surfaces that matter once you are past the first integration. Stated for what exists, including the gaps.

Edge

Edge Audit

The live architecture demo: a local PII store, a subject_ref on the wire, and AffixIO attestation without personal data leaving the host. Edge packs at GET /v1/edge/spent-pack and GET /v1/edge/revocation-pack.

Demo · /edge-audit/

Infrastructure as code

OpenAPI is the contract

There is no first-party Terraform, Pulumi or Crossplane provider. Teams that need IaC drive key issuance and health checks through a generic HTTP provider against the OpenAPI schema.

No first-party provider

Access

OAuth where it exists

Hub signs in with email and password. OAuth 2.1 with PKCE is live for the remote MCP server. POST /v1/oidc/token issues an OIDC-style token bound to a proof. There is no SAML integration and no claim of enterprise SSO for Hub itself.

MCP OAuth · OIDC token endpoint

One map for every team that integrates

When many teams integrate at once, they need one canonical map. This is it. Deep pages stay deep. This page points.

MCP

Agent tools over the live contract.

MCP

Export

SIEM path.

SIEM

Questions

Where to start, and what is not claimed.

Where should I start?

If you run Node, start with affixio for zero-knowledge prove or @affix-io/sdk-light for millisecond HMAC prove. If you run anything else, call the HTTP API. Add webhooks for latency and the evidence export for completeness.

Does AffixIO have a Terraform provider?

No. There is no first-party Terraform, Pulumi or Crossplane provider. The OpenAPI schema is the contract. Drive what you need through a generic HTTP provider against it.

Does AffixIO support enterprise SSO?

Hub accounts sign in with email and password today. OAuth 2.1 with PKCE is live for the remote MCP server, and POST /v1/oidc/token issues an OIDC-style token bound to a proof. There is no SAML identity provider integration and no claim of enterprise SSO for Hub itself.

Are Light proofs zero knowledge?

No. Light proofs are HMAC-SHA256 state proofs. The UltraHonk path in affixio is the zero-knowledge path. The comparison is on the browser page.

What is Connections?

The canonical map of AffixIO access surfaces.

Why not a new microsite per team?

Citations die when URLs shuffle. Deep pages stay deep. This page points.

Where do I start as an engineer?

Developers, then OpenAPI, then Hub.

Next

Request a key, or open Hub and register a webhook while you decide which client to keep.

Pricing Open Hub Integrations