Quickstart

Make your first AKRUM API request in under five minutes. You'll generate cryptographic-grade randomness backed by AKRUM's Cellular Automata (Rule 30) entropy engine mixed with the OS CSPRNG through HKDF-SHA-256.

1. Sign up

Create a free account: no credit card required. The Free tier ships with 5,000 requests / month.

Create an account →

2. Generate an API key

Go to API keys and click New key. Keys begin with ak_live_.

3. Make your first request

Export your key as AKRUM_KEY and run one of the samples below. All four call the live GET /v1/random endpoint and produce 32 bytes of hex-encoded randomness on the first try.

curl https://akrum.io/api/public/v1/random \
  -H "Authorization: Bearer $AKRUM_KEY" \
  -G --data-urlencode "bytes=-n">32" \
     --data-urlencode "format=hex"

4. Verify the response

Every success response uses the same { data, meta } shape. meta.rate mirrors your live per-second and monthly quotas. Rate-limit headers accompany every response: see Rate limits.

{
  "data": {
    "bytes": 32,
    "format": "hex",
    "value": "9f1c4e...d8a2",
    "source": "akrum-ca-hkdf-v1"
  },
  "meta": {
    "algorithm_suite": "envelope-argon2id-aesgcm-v1",
    "suite_version": 1,
    "pqc_available": {
      "signatures": { "suite": "mldsa65-v1", "enable": "append ?sign=1 to any request" },
      "verify_key_url": "/api/public/v1/pqc/verify-key",
      "hybrid_kem": {
        "suite": "hybrid-mlkem768-x25519-aesgcm-v1",
        "encapsulate_url": "/api/public/v1/kem/encapsulate",
        "decapsulate_url": "/api/public/v1/kem/decapsulate",
        "required_scope": "kem",
        "standards": ["NIST FIPS 203", "RFC 7748", "RFC 5869", "NIST SP 800-38D"]
      }
    },
    "rate": { "rps_limit": 10, "monthly_used": 1, "monthly_limit": 5000 }
  }
}

Append ?sign=1 to any request to receive detachable ML-DSA-65 signature headers (x-akrum-signature, x-akrum-signature-suite, x-akrum-signature-message-sha256, x-akrum-signed-at).

Guardrails for autonomous AI agents

AI Agent Guardrails provides the deterministic authorization path in the AI Agents product. AI may assist with interpretation and orchestration, but the policy engine owns every allow, deny, or challenge decision. Build custom guardrails with attribute-based policies, or turn on one of the five prebuilt guardrails powered by AKRUM's AI Agents through require_evaluator within AI Agent Guardrails.

1. Create an agent identity

Open the Agents Console, select Agent Guardrails → Identities, and register the lowercase handle your agent will send, such as payments-agent. Unknown or revoked identities fail closed to deny.

2. Write a policy

Under Agent Guardrails → Policies, create a rule for the identity, action, and resource patterns you want to permit, deny, or challenge. Add conditions and obligations as needed. Leave the evaluator empty for a custom guardrail, or set require_evaluator to turn on a prebuilt guardrail within AI Agent Guardrails.

3. Authorize the action

Create an API key with the guard scope, then call the shipped authorization endpoint before the tool runs.

curl https://akrum.io/api/public/v1/authorize   -H "Authorization: Bearer $AKRUM_KEY"   -H "Content-Type: application/json"   -d '{
    "agent": "payments-agent",
    "action": "create_payout",
    "resource": "acct:-n">1234",
    "context": { "amount_usd": -n">2500 }
  }'

4. Enforce with the SDK

The dependency-free SDK runs your action only on allow. It throws on deny orchallenge, carrying the reason and obligations, and fails closed if Guard is unreachable.

import { createGuardClient } from "./akrum-guard";

const guard = createGuardClient({ apiKey: process.env.AKRUM_KEY! });

await guard.enforce({
  agent: "payments-agent",
  action: "create_payout",
  resource: "acct:class="tk-n">1234",
  context: { amount_usd: class="tk-n">2500 },
});

await createPayout(); class="tk-c">// reached only after allow

5. Verify the signed decision

Every completed decision is logged and, when signing is available, carries an ML-DSA attestation. Verify the stored signed payload server-side or export it for offline verification with the public key.

curl -X POST https://akrum.io/api/public/v1/guard/decisions/<decision_id>/verify   -H "Authorization: Bearer $AKRUM_KEY"

curl https://akrum.io/api/public/v1/guard/verification-key

Continue with the Guard SDK guide and signed-decision verification.