Try the control, then choose an integration

For a hosted integration, first confirm the tenant, supported capability, environment and credential contract with your integration owner. Do not assume checkout provisions access. You will need:

• STRIX_TENANT_ID — your tenant slug.
• STRIX_API_KEY — a sk_live_* per-tenant API key issued through the approved provisioning process. Use a development credential for synthetic tests; never place a live key in a browser demo. Confirm rotation and revocation with your operator.

STRIX_API_URL=https://www.strixgov.com
STRIX_TENANT_ID=<your-slug>
STRIX_API_KEY=sk_live_<...>
STRIX_GOVERNANCE_ENABLED=true

For Vercel / Render / Fly / similar platforms, add these as project-level environment variables and redeploy.

Verification is always free and open via @strixgov/sdk + @strixgov/verifier. Governed execution itself — the policy engine that issues and redeems decision tokens — is the commercial Strix platform: it is hosted/operated, not a package you install (@strixgov/governance-core is private and is never published to a registry). Contact us to get your tenant provisioned and the integration details.

Once provisioned, your governed call site looks like this:

// Provided through your commercial Strix integration (hosted control plane).
await StrixGovernance.governedAction({
  capability: 'database.write.delete-user',
  actor: { id: requestingUserId, role: requestingUserRole },
  payload: { userId: id, reason: 'admin-initiated' },
  execute: async () => {
    await db.user.delete({ where: { id } });
  },
});

Run it once. You'll get back an evidenceId. Verify it:

npx @strixgov/verifier@latest <evidenceId>

You should see Status: VERIFIED. This is the proof moment — any third party can verify the same record against the public JWKS at /.well-known/strix-jwks.json.

npm install @strixgov/tool-gateway

The tool-gateway is local-first by default — receipts are produced and signed locally without a kernel round-trip per call. Connected mode (which syncs receipts back to the platform via the v0.4 wire envelope) is opt-in.

See the npm package README for full configuration. Start in local-only mode; your CS lead can walk you through enabling connected mode after your first batch of receipts is producing.

Two endpoints, both at https://www.strixgov.com. Auth on every request:

Authorization: Bearer <STRIX_API_KEY>
X-Tenant-Id: <STRIX_TENANT_ID>   # optional; must match the key's tenant if sent

Pre-execution policy

POST /api/v1/evaluate
Content-Type: application/json

{
  "capabilityId": "database.write.delete-user",
  "actor": { "id": "u_123", "role": "admin" },
  "context": { "userId": "u_456" }
}

Response: { "action": "allow" | "deny" | "escalate", ... }.

Post-execution evidence

POST /api/v1/evidence/ingest
Content-Type: application/json

{
  "records": [
    {
      "tenantId": "<STRIX_TENANT_ID>",
      "capabilityId": "database.write.delete-user",
      "actorId": "u_123",
      "actorRole": "admin",
      "decision": "ALLOW",
      "evidenceHash": "<sha256 of payload>"
    }
  ]
}

When the verifier returns Status: VERIFIED, three independent things have been checked:

• Cryptographic validity. The Ed25519 signature checks out against the public key in the Strix JWKS.
• Environment binding.The record was signed in the environment stamped on it (production / staging / development). You can't take a dev record and replay it as production.
• Tenant binding. The record was signed against the tenant stamped on it. Cross-tenant replay fails.

• X-Tenant-Id mismatch.If sent and it doesn't match your key's tenant, the API returns 401.
• Execution tokens are single-use and short-lived. Don't cache an evaluate response and reuse the token 10 minutes later. Re-evaluate per execution.
• STRIX_GOVERNANCE_ENABLED=false is a silent no-op. governedAction still calls your execute block but does not sign anything.