Quick Start

Create a workspace

Sign up at app.veto.tools and create a workspace. A workspace is the container for your agents, policies, and audit logs.

Get your API key

In the dashboard, go to Settings → API Keys and create a new key.

The raw API key is shown once at creation and never again — only the key prefix is stored. Copy it immediately and save it somewhere secure, such as a password manager or secrets vault.

Your key will look like this:

veto_a3f8c2e1d4b7...

For local development, store it in an environment variable:

export VETO_API_KEY=veto_a3f8c2e1d4b7...

Install the SDK

npm install @useveto/node

pip install useveto

Create an agent

An agent represents an AI actor — a bot, workflow, or model — that calls tools. Register one using the SDK or the dashboard.

import { VetoClient } from "@useveto/node";

const veto = new VetoClient({ apiKey: process.env.VETO_API_KEY! });

const agent = await veto.createAgent({
  name: "support-bot",
  description: "Customer support agent that can send emails and look up orders",
});

console.log(agent.id); // e.g. "agent_01j..."

import os
from veto import VetoClient, CreateAgentInput

veto = VetoClient(api_key=os.environ["VETO_API_KEY"])

agent = veto.create_agent(CreateAgentInput(
    name="support-bot",
    description="Customer support agent that can send emails and look up orders",
))

print(agent.id)  # e.g. "agent_01j..."

You can also create agents directly in the dashboard under Agents → New agent. Copy the agent ID — you’ll use it in authorization checks.

Create a policy

Policies define what your agent is allowed to do. The following example creates a policy that allows the support-bot agent to call send_email and lookup_order, and nothing else.

const policy = await veto.createPolicy({
  agentId: agent.id,
  name: "Support bot — allowed tools",
  rules: [
    {
      type: "tool_allowlist",
      tools: ["send_email", "lookup_order"],
    },
  ],
  priority: 10,
  enabled: true,
});

console.log(policy.id);

from veto import CreatePolicyInput, PolicyRule

policy = veto.create_policy(CreatePolicyInput(
    agent_id=agent.id,
    name="Support bot — allowed tools",
    rules=[
        PolicyRule(
            type="tool_allowlist",
            tools=["send_email", "lookup_order"],
        )
    ],
    priority=10,
    enabled=True,
))

print(policy.id)

Any tool not on the allowlist is blocked by default — you don’t need to define a denylist.

Make an authorization check

Call veto.authorize() before each tool execution. Pass the agent ID, the tool name, and (optionally) the call parameters.

const result = await veto.authorize(
  agent.id,        // agentId: string
  "send_email",    // toolName: string
  {                // parameters (optional)
    to: "customer@example.com",
    subject: "Your order has shipped",
  },
);

if (result.allowed) {
  // proceed with the tool call
  await sendEmail(result);
} else {
  console.log(`Blocked: ${result.reason}`);
}

result = veto.authorize(
    agent_id=agent.id,
    tool_name="send_email",
    parameters={
        "to": "customer@example.com",
        "subject": "Your order has shipped",
    },
)

if result.allowed:
    # proceed with the tool call
    send_email(result)
else:
    print(f"Blocked: {result.reason}")

The response includes:

Field	Type	Description
`allowed`	`boolean`	Whether the action is permitted
`outcome`	`"allowed" \| "denied"`	The decision
`matchedPolicyId`	`string \| null`	The policy that produced this decision, or `null` for default deny
`reason`	`string`	Human-readable explanation
`evaluatedAt`	`string`	ISO 8601 timestamp of the evaluation

A denied response looks like this:

{
  "allowed": false,
  "outcome": "denied",
  "matchedPolicyId": null,
  "reason": "No policy allows tool 'delete_account' for this agent",
  "evaluatedAt": "2026-04-08T12:00:00.000Z"
}

What’s next

Authentication

Learn about API key scopes, rate limits, and secure key management.

Policies

Explore all five rule types — allowlists, denylists, parameter constraints, rate limits, and time windows.

Node.js SDK

Full SDK reference including MCP middleware.

API Reference

REST API reference for every endpoint.

Get Started

Core Concepts

Integrations

Dashboard

Quick Start

What’s next

Authentication

Policies

Node.js SDK

API Reference

​What’s next

Authentication

Policies

Node.js SDK

API Reference

What’s next