AffixIO logoAffixIO
Request Access

Connections

Every way in, on one page.

AffixIO is a verification API with two Node packages around it, a remote MCP server, signed webhooks and an evidence export. This page is the map. Each card links to a surface that exists today, stated for what it actually does.

Clients Events and evidence

Last reviewed against the published packages and the running API.

A dense bundle of network cables of different colours, photographed end-on
Many paths, one fabric. Photograph by Michael Jastremski, CC BY-SA 3.0, cropped and desaturated.

Pick by what you are building

Most teams land on one client and one event path. The client proves or verifies. The event path tells the rest of the stack that something happened. Everything else on this page is optional.

You run Node and need a real ZK proof

Install @affix-io/sdk. Local UltraHonk prove, then sync for ML-DSA-65 attestation and Merkle anchoring.

You run Node and need milliseconds

Install @affix-io/sdk-light. HMAC Light prove and local verify. Light is not zero knowledge.

You run Python, Go, Java or anything else

Call the HTTP API. The Python page has a working client, webhook checks and Merkle inclusion in the standard library.

Clients

Four places a host can speak from. Two are published packages. Two are contracts you implement against the API.

Node

@affix-io/sdk

UltraHonk zero-knowledge prove over Noir circuits, ML-DSA-65 sync, Merkle audit, carriers and offline queue. Apache-2.0 on npm, Node 18+.

Package · 1.1.1

Node

@affix-io/sdk-light

Millisecond HMAC Light prove and verifyLocal. Same sync and audit surfaces. Light proofs are not SNARKs.

Package · 1.1.3

Python

HTTP client, no PyPI package

There is nothing on PyPI. A forty-line client, webhook signature checks with hmac, and Merkle inclusion with hashlib.

Contract · standard library

Browser

No WASM prover

No browser package. Keep the key on a server you control. Light is not ZK. Public Merkle root and public key are readable without a key.

Pattern · backend verify

API and agents

The contract everything else hangs off, and the two ways an agent reaches it.

HTTP

api.affix-io.com

Base URL, authentication, rate limits, OpenAPI schema. Prefer direct calls for production throughput.

OpenAPI · /v1/openapi.json

MCP

Remote MCP server

Streamable HTTP with OAuth 2.1 and PKCE. Tools affix_api_read and affix_api_write, resource affix-openapi.

Connect · /mcp/

Agents

For agents

How to gate tool execution on a verify outcome without putting end-user data into a chat context.

Reference · agent readiness

Events and evidence

Two different answers to the same question. Webhooks for latency. The export for completeness.

Push

Signed webhooks

Five events, HMAC-SHA256 over {timestamp}.{raw_body}, a five minute replay window and three attempts. Manage endpoints at Hub.

Manage · hub.affix-io.com/webhooks/

Pull

SIEM and evidence export

Newline-delimited JSON of every event AffixIO holds for your keys. Ten thousand per request, JSON variant for auditors.

GET · /api/export/siem

Edge, infrastructure and access

Surfaces that matter once you are past the first integration. Stated for what exists, including the gaps.

Edge

Edge Audit

The live architecture demo: a local PII store, a subject_ref on the wire, and AffixIO attestation without personal data leaving the host. Edge packs at GET /v1/edge/spent-pack and GET /v1/edge/revocation-pack.

Demo · /edge-audit/

Infrastructure as code

OpenAPI is the contract

There is no first-party Terraform, Pulumi or Crossplane provider. Teams that need IaC drive key issuance and health checks through a generic HTTP provider against the OpenAPI schema.

No first-party provider

Access

OAuth where it exists

Hub signs in with email and password. OAuth 2.1 with PKCE is live for the remote MCP server. POST /v1/oidc/token issues an OIDC-style token bound to a proof. There is no SAML integration and no claim of enterprise SSO for Hub itself.

MCP OAuth · OIDC token endpoint

Questions

Where to start, and what is not claimed.

Where should I start?

If you run Node, start with @affix-io/sdk for zero-knowledge prove or @affix-io/sdk-light for millisecond HMAC prove. If you run anything else, call the HTTP API. Add webhooks for latency and the evidence export for completeness.

Does AffixIO have a Terraform provider?

No. There is no first-party Terraform, Pulumi or Crossplane provider. The OpenAPI schema is the contract. Drive what you need through a generic HTTP provider against it.

Does AffixIO support enterprise SSO?

Hub accounts sign in with email and password today. OAuth 2.1 with PKCE is live for the remote MCP server, and POST /v1/oidc/token issues an OIDC-style token bound to a proof. There is no SAML identity provider integration and no claim of enterprise SSO for Hub itself.

Are Light proofs zero knowledge?

No. Light proofs are HMAC-SHA256 state proofs. The UltraHonk path in @affix-io/sdk is the zero-knowledge path. The comparison is on the browser page.

Next

Request a key, or open Hub and register a webhook while you decide which client to keep.

Request access Open Hub Integrations