Agreely
FR EN

60-second quickstart

Gate a real data use in under a minute. The whole integration is one call.

1. Install

# TypeScript / Node
npm install @agreely/sdk

# PHP
composer require agreely/sdk

# CLI (agent-native, one binary)
npm install -g @agreely/cli

2. Set your key

A key alone identifies your tenant. There is no session and no CSRF; every call is stateless and server-to-server.

export AGREELY_API_KEY=agr_live_xxx

Keys carry scopes: check authorizes the consent check, issue authorizes the consent-request endpoints, and either scope can read the catalog.

3. Gate a data use

Send the raw human category and purpose labels. Agreely normalizes them server-side to the exact key the catalog and the approval wrote. Never normalize client-side.

import { Agreely } from "@agreely/sdk";

const agreely = new Agreely({ apiKey: process.env.AGREELY_API_KEY! });

// Send RAW human labels. Agreely normalizes them server-side.
if (await agreely.check("cust_8812", "Phone number", "Billing")) {
  // allowed: use the phone number for billing
} else {
  // denied: do not use it
}
use Agreely\Sdk\Agreely;

$agreely = new Agreely(['apiKey' => getenv('AGREELY_API_KEY')]);

if ($agreely->check('cust_8812', 'Phone number', 'Billing')) {
    // allowed: use the phone number for billing
} else {
    // denied: do not use it
}
export AGREELY_API_KEY=agr_live_xxx

agreely check cust_8812 "Phone number" "Billing" --json
# {"decision":"allow","status":"active","consentRef":"0x..."}
# exit 0 on allow, 10 on deny
curl -sS https://api.agreely.ca/v1/check \
  -H "Authorization: Bearer $AGREELY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customerId":"cust_8812","category":"Phone number","purpose":"Billing"}'
# {"decision":"allow","status":"active","consentRef":"0x...","assurance":"citizen_signed","tier":"full","validUntil":"2027-...Z","checkedAt":"2026-...Z"}

That is the whole integration. A few properties worth knowing immediately:

  • Deny is a normal 200. A consent decision, allow or deny, is always a successful response. Only auth, validation, rate-limit, and outage are errors.
  • Fail-closed. If Agreely is unreachable, check() returns false. Opting specific categories into a scoped, audited fail-open is possible but deliberately hard. See handling outages.
  • Never cache the decision. The response carries validUntil, the consent's end, but a withdrawal ends it earlier and denies from the very next call. Check on every use.
  • customerId is your reference, never a citizen DID. Agreely never links it to the person's identity (see unlinkability).

Next