Your agent hands over a task. You decide where it goes.

How a task goes

1. 1. You register where things may go — the https address of your own system or of a flow in the automation tool you already use — which kinds of task it may receive, and how it answers. The signing secret is made for you and shown once.
2. 2. Your agent sees which tasks you allow to which system (the label and the host, never the address), prepares one, and gets back the exact data and a fixed reference. It cannot name, add or change a destination.
3. 3. You see the destination, the exact JSON, the expected action and the cost, and approve or reject. A changed request or a changed destination needs a new approval. Or you pre-approve one kind of task for one system, with a number per day, and withdraw that whenever you like.
4. 4. Jithox sends it once, signed, with the fixed reference on every attempt — to the address you registered or nowhere. Redirects are never followed; private and intranet addresses are refused.
5. 5. Both of you read the outcome. After a lost answer nothing is re-sent by itself; running it again sends the same reference, so a system that checks it acts once. We cannot make another company's system do that, and we say so.

Five outcomes, never mixed up

• Offered — it arrived at the other system, which has not confirmed anything
• Accepted — the other system confirmed it took the job
• Completed — the other system reported the business action as done
• Failed — the other system did not accept it, or nothing was sent
• Unknown — no answer after the bounded attempts; it may or may not have run

What it costs

Free while this is a Labs capability. No price has been set for a run; none is charged. The cost is shown to you with every approval request and to the agent with every prepared run, so a price — if one is ever set — is seen before a run, never after.

On your side: a receiver you can run

One short Node file, no packages: it checks the signature and the age of the request, acts once per reference, and answers in the JSON contract. In n8n, Make or Zapier the same three steps go into the flow behind your webhook; without a JSON answer, choose the "received only" contract and a run ends as offered.

// receiver.mjs  —  JITHOX_SECRET=<the secret shown once> PORT=8787 node receiver.mjs
// Put it behind https on a public host (your own server, or a tunnel while you try it).
import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const secret = process.env.JITHOX_SECRET;
if (!secret) throw new Error("Set JITHOX_SECRET to the signing secret of this destination.");
const handled = new Map(); // idempotency key -> your own reference. Use your database in real life.

createServer(async (req, res) => {
  const parts = [];
  for await (const chunk of req) parts.push(chunk);
  const raw = Buffer.concat(parts);

  // 1. Is it really from Jithox, and recent? HMAC-SHA256 over "<t>.<raw body>".
  const sig = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(String(req.headers["x-jithox-signature"] ?? ""));
  const expected = sig && createHmac("sha256", secret).update(sig[1] + ".").update(raw).digest();
  const recent = sig && Math.abs(Date.now() / 1000 - Number(sig[1])) <= 300;
  if (!sig || !recent || !timingSafeEqual(expected, Buffer.from(sig[2], "hex"))) {
    res.writeHead(401).end();
    return;
  }

  // 2. Act ONCE per key. A repeat after a lost answer carries the same key.
  const key = String(req.headers["x-jithox-idempotency-key"]);
  const duplicate = handled.has(key);
  if (!duplicate) {
    const run = JSON.parse(raw.toString("utf8"));
    handled.set(key, "demo-" + (handled.size + 1));
    if (!run.test) console.log("create", run.data.recordType, run.data.fields); // your business action goes here
  }

  // 3. Say what you did. Under the JSON contract this is what makes the run "accepted".
  res.writeHead(200, { "content-type": "application/json" });
  res.end(JSON.stringify({ accepted: true, reference: handled.get(key), duplicate }));
}).listen(Number(process.env.PORT ?? 8787));