Question 1

What is ottr?

Accepted Answer

Ottr generates secure, single-use approval URLs for automations. When a URL is clicked, it sets a specific value that your automation can poll for. It's used for CI/CD approvals, server shutdown confirmations, AI agent guardrails, and any human-in-the-loop automation steps.

Question 2

How does it work?

Accepted Answer

It's three API calls: (1) POST to /v1/approvals to generate an approval URL with the value to set when clicked, (2) Share that URL via Slack, email, SMS, etc., (3) Poll GET /v1/key/{path} until the value changes. No webhooks, no OAuth, no SDKs required.

Question 3

Is it secure?

Accepted Answer

Yes. All values are encrypted at rest using ChaCha20-Poly1305 (AEAD). Approval URLs are single-use with configurable TTL. You can optionally require a PIN for extra security. API keys are hashed with SHA-256 for secure storage.

Question 4

What data do you collect on approval pages?

Accepted Answer

By default, we don't collect IP addresses or browser information. If you enable 'Privacy Data Collection' in your project settings, we'll record the IP address and user agent of the person who clicks the approval link. This data is shown in your audit trail and can help with security reviews.

Question 5

How long are approval URLs valid?

Accepted Answer

You configure the TTL (time-to-live) when creating each approval token. After the TTL expires, the URL can no longer be used. Typical values range from 5 minutes to 24 hours depending on your use case.

Question 6

Can I have multiple approval buttons?

Accepted Answer

Yes! You can define up to 3 actions per approval token. Each action has a key, value, optional label, and optional style. For example: Approve (green), Reject (red), Defer (gray). When clicked, the corresponding value is set.

Question 7

What happens if the same approval URL is clicked twice?

Accepted Answer

Approval URLs are single-use. Once clicked, the token is marked as 'executed' and cannot be used again. Subsequent clicks will show that the approval has already been processed.

Question 8

Can I invalidate an approval URL before it's used?

Accepted Answer

Yes. Use POST /v1/approvals/{approval_id}/invalidate with your API key, or invalidate from the dashboard. Invalidated tokens cannot be used.

Question 9

What's the difference between Write and Read API keys?

Accepted Answer

Write API keys (otw_*) have full access: create approvals, read/write values, and invalidate tokens. Read-only keys (otr_*) can only read values and check for pending approvals—useful for monitoring systems that shouldn't be able to create or modify data.

Question 10

Can I get notified when an approval is used?

Accepted Answer

Yes! Configure Slack integration in your project settings. You can receive notifications when approvals are created, executed, expired, or invalidated. Multiple Slack channels are supported with different notification preferences.

Question 11

What's the PIN feature?

Accepted Answer

Optional security PIN adds a second factor to approval pages. When enabled, users must enter the correct PIN to complete the approval. After 5 failed attempts, the token is locked. Set up PINs in your project's Security settings.

Question 12

How much does it cost?

Accepted Answer

Ottr is free while in beta. We'll announce pricing before the beta ends, with advance notice to all users.

Question 13

What are the rate limits?

Accepted Answer

During beta, reasonable use limits apply. We'll publish specific limits before general availability. If you need higher limits for your use case, contact us.

Question 14

Can I self-host ottr?

Accepted Answer

Not currently. Ottr is a hosted service. If you have specific requirements around data residency or compliance, reach out to discuss options.

Frequently Asked Questions