Connect your AI agent to e-signatures via MCP. It prepares, you sign.

Connect in three steps, then let it prepare

Built so that agents cannot overreach

Not another password vault

Giving agents stored passwords gets them past a login. CodeB goes the other way: the app never needs a password, it receives a narrow permission from you, and anything legally binding – a signature – is done by a person with the EUDI wallet or a qualified signature card.

For developers

Open standards, no proprietary SDK. Apps connect with the MCP sign-in (MCP authorization: OAuth 2.1 with PKCE, Client ID Metadata Documents or dynamic client registration, RFC 9728 and RFC 8414 discovery – most MCP clients do this by themselves). Agents without a screen use OpenID CIBA (poll mode): the person approves on Your agents. The tools use the documented signing requests API, so every check and limit applies unchanged.

# Apps that are set up with a configuration file: add the server by its address.
# The app opens CodeB by itself when it connects (MCP sign-in) - no token to paste.
{
  "mcpServers": {
    "codeb-signing": { "url": "https://www.aloaha.com/mcp" }
  }
}

# Call a tool with the access token (what every connected app does)
POST https://www.aloaha.com/mcp
Authorization: Bearer <access_token>
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_signing_request",
 "arguments":{"documents":[{"name":"Service agreement","pdf_base64":"JVBERi0x..."}],
  "sign_myself":true,"invite":["client@example.com"],
  "signature_fields":[{"document":0,"signer":1,"page":-1,"position":"bottom-left"},
                      {"document":0,"signer":2,"page":-1,"position":"bottom-right"}]}}}

# Agents without a screen (OpenID CIBA, poll mode): 1. ask the person
curl -u "agent-<id>:<secret>" \
  -d "scope=openid sign_requests" -d "login_hint=<your user name>" \
  -d "binding_message=4711" \
  https://www.aloaha.com/oidc.ashx?action=bc-authorize
# -> {"auth_req_id":"...","expires_in":300,"interval":5}

# 2. The person approves on agent-approvals.html; the agent polls every 5 s
curl -u "agent-<id>:<secret>" \
  -d "grant_type=urn:openid:params:grant-type:ciba" -d "auth_req_id=..." \
  https://www.aloaha.com/oauth2/v1/token
# -> 400 {"error":"authorization_pending"} ... then
# -> {"access_token":"...","expires_in":3600,"scope":"openid sign_requests","id_token":"..."}

MCP tools

Frequently asked questions

Related