> This page is for version 🇦🇺 AU (default).
> For other versions, use one of these documentation indexes:
> - 🇦🇺 AU (default): https://docs.humanapproved.com/au/llms.txt
> - 🇬🇧 UK: https://docs.humanapproved.com/uk/llms.txt
> - 🇺🇸 US: https://docs.humanapproved.com/us/llms.txt

> This is HumanApproved's documentation, as Markdown for AI agents. /llms.txt lists every page; /llms-full.txt has them all. If you're helping someone integrate HumanApproved, start with /guides/ai-coding-agents.

# How it works

> How HumanApproved checks a checkout, pauses an AI agent's purchase, lets the customer approve with an SMS code, and lets the insurer verify the approval.

## The flow

#### You set up the product in the portal

In the portal, set up the product's quote fields, approval page, branding, pause panel and approval settings. Then publish a version. See [Set up a product](/au/portal/set-up-a-product).

#### The embed protects the payment step

Add the embed to every page of your quote journey and point it at the button or form that continues to payment. See [Add the embed](/au/guides/add-the-embed).

#### Continuing to payment runs a check

When someone continues to payment, the embed holds the click and creates a **check**. HumanApproved returns `continue` or `review`, depending on what it finds and on the product's **When to ask for approval** setting. See [Agent detection](/au/concepts/agent-detection).

#### Continue, or pause for a review

On `continue`, the original click proceeds unchanged. On `review`, a **review** is created. The embed sends the quote and the customer's mobile, and shows the agent a pause panel with a link to pass to the customer.

#### The customer approves the purchase

The customer opens the link, checks the quote and the answers the agent gave, ticks the statements and opens the required documents. They then enter a one-time code sent to the mobile on the quote to approve. This page is for humans: with the product's bot check on, a browser identified as a bot can't ask for a code or approve. See [Approval methods](/au/concepts/approval-methods).

#### Once approved, the agent can proceed

The embed watches the review's status. When it's approved, the pause panel closes and the payment step proceeds automatically. If the customer declines, or the link expires, the panel tells the agent nothing was paid, and the step stays paused.

#### Your server verifies before you bind

Before you issue the policy, your server reads the review's outcome with your secret key and checks it's `approved` for this quote. See [Verify on your server](/au/guides/verify-on-your-server).

## Who holds each credential

| Credential               | Held by                                    | Used for                                            |
| ------------------------ | ------------------------------------------ | --------------------------------------------------- |
| Publishable key (`pk_…`) | Your page, or your server                  | Creating checks and reporting their results         |
| Review token             | The embed, or your server in an agent flow | Sending the quote and following one review's status |
| Secret key (`sk_…`)      | Your server only                           | Reading a review's full outcome                     |

In an agent flow, keep the review token on your server. See [Keys and environments](/au/concepts/keys-and-environments).

## When there's no approval step

* **Not an agent.** If the product is set to ask for approval only when an agent is detected, the check returns `continue` for every journey not flagged as an agent.
* **Monitor only.** A monitor-only product records every check and always returns `continue`. See [Monitor only](/au/guides/monitor-only).
* **No response in time.** If HumanApproved doesn't respond within the configured [timeout](/au/embed/sdk/options#timeoutms) (default 2.5 seconds), the embed lets the step proceed and reports the check as `fail_open`.

## Without the embed

From your own server or an agent tool (such as an MCP tool that binds a policy), you make the same calls yourself: create a check, send the quote, give the agent the link, poll the status, then bind and report the result. See [Server and agent flows](/au/guides/server-and-agent-flows).