The integration contract before you request access

// Android — install once, where you build your HTTP client.
val client = OkHttpClient.Builder()
    .addInterceptor(
        YuthentOkHttpInterceptor.Builder()
            .activityProvider { currentActivity }
            .onboardingTrigger { url -> startEnrolment(url); true }
            .build()
    )
    // Must outlast the approval, or OkHttp cancels the ceremony.
    .callTimeout(90, TimeUnit.SECONDS)
    .build()

// iOS — the same idea, registered globally.
YuthentURLProtocol.register { url in startEnrolment(url) }

// Your existing call does not change. When your backend asks for an
// approval, the interceptor runs the ceremony on the device and
// retries this same request with the result attached.
val response = client.newCall(request).execute()

// Your backend — the verify step in front of the route.
// The level comes from your own policy, per action.
const approved = yuthent(policy.levelFor("transfer"), {
  apiKey: process.env.YUTHENT_API_KEY,
});

app.post("/transfer", approved, (req, res) => {
  // Reached only on an approval that verified. Unchanged otherwise.
  runTransfer(req.body);
});

// The other path: an agent acting under a mandate the person
// already signed. Ask before you act, and handle three answers.
const { decision, authorizationJws } = await authorizeUnderMandate({
  actionType: "transfer",
  actionContextId: ref,
  riskLevel: "HIGH",
});

switch (decision) {
  case "MANDATE_AUTHORIZED":
    // Inside the bounds the person sealed. Verify, then act.
    await verifyMandateAuthorization(authorizationJws);
    return runTransfer(req.body);
  case "STEP_UP_REQUIRED":
    // A bound was exceeded. This becomes a human approval.
    return askThePerson();
  default:
    // No mandate covers it, or the one that did was revoked.
    return refuse();
}