Developer Quickstart

First receipt in under 5 minutes

Three steps: get a key, invoke a skill, verify the receipt. Pick your language below.

Get API key

Invoke a skill

Verify the receipt

1 Get your API key

Pilot customers: your key was emailed when you signed up. Retrieve it at /account/billing.
Not a pilot yet? Sign up for the pilot program →

2 Install the client

📋 No npm package yet — copy axiom-client.js directly into your project. It's ~100 LOC and has zero dependencies.

bash

# Download the client file
curl -sO https://axiom-ai-19.polsia.app/sdk/axiom-client.js

3 Invoke and verify

javascript

// quickstart.js
const { AxiomClient } = require('./axiom-client');

const axiom = new AxiomClient('YOUR_API_KEY');

async function main() {
  // Invoke the echo skill — get a signed receipt back
  const { receipt, result } = await axiom.invoke(
    'echo',
    { message: 'compliance check' },
    { caller: 'quickstart-demo' }
  );

  console.log('Receipt ID: ', receipt.id);
  console.log('Skill:      ', receipt.skill_name);
  console.log('Timestamp:  ', receipt.timestamp);
  console.log('Signature:  ', receipt.signature.slice(0, 24) + '…');

  // Verify the receipt — timing-safe HMAC check
  const verification = await axiom.verify(receipt.id);
  console.log('verified:        ', verification.verified);
  console.log('signature_valid: ', verification.signature_valid);
  console.log('Verify URL:  https://axiom-ai-19.polsia.app/verify?id=' + receipt.id);
}

main().catch(console.error);

Expected output

Terminal

Receipt ID:  142
Skill:       echo
Timestamp:   2026-05-27T08:00:00.000Z
Signature:   xK8mP2nLqRvT4wYzAb3c…
verified:         true
signature_valid:  true
Verify URL:  https://axiom-ai-19.polsia.app/verify?id=142

1 Get your API key

Pilot customers: your key was emailed when you signed up. Retrieve it at /account/billing.
Not a pilot yet? Sign up for the pilot program →

2 Install the client

📋 No PyPI package yet — copy axiom_client.py into your project. Standard library only, no pip install needed.

bash

# Download the client file
curl -sO https://axiom-ai-19.polsia.app/sdk/axiom-client.py

3 Invoke and verify

python

# quickstart.py
from axiom_client import AxiomClient

axiom = AxiomClient("YOUR_API_KEY")

# Invoke the echo skill — get a signed receipt back
data = axiom.invoke("echo", {"message": "compliance check"}, caller="quickstart-demo")
receipt = data["receipt"]

print("Receipt ID: ", receipt["id"])
print("Skill:      ", receipt["skill_name"])
print("Timestamp:  ", receipt["timestamp"])
print("Signature:  ", receipt["signature"][:24] + "…")

# Verify the receipt — timing-safe HMAC check
v = axiom.verify(receipt["id"])
print("verified:        ", v["verified"])
print("signature_valid: ", v["signature_valid"])
print("Verify URL:  https://axiom-ai-19.polsia.app/verify?id=" + str(receipt["id"]))

Expected output

Terminal

Receipt ID:  142
Skill:       echo
Timestamp:   2026-05-27T08:00:00.000Z
Signature:   xK8mP2nLqRvT4wYzAb3c…
verified:         True
signature_valid:  True
Verify URL:  https://axiom-ai-19.polsia.app/verify?id=142

1 Get your API key

Pilot customers: your key was emailed when you signed up. Retrieve it at /account/billing.
Not a pilot yet? Sign up for the pilot program →

2 Invoke a skill

bash

curl -s -X POST https://axiom-ai-19.polsia.app/api/receipts/invoke \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "skill_name": "echo",
    "inputs": { "message": "compliance check" },
    "caller": "quickstart-demo"
  }' | jq .

Response

{
  "receipt": {
    "id": 142,
    "skill_name": "echo",
    "timestamp": "2026-05-27T08:00:00.000Z",
    "inputs_hash": "a1b2c3d4e5f6…",
    "output_hash":  "f6e5d4c3b2a1…",
    "signature":    "xK8mP2nLqRvT4wYzAb3c…",
    "verification_status": "verified",
    "source": "live",
    "caller": "quickstart-demo"
  },
  "result": { ... }
}

3 Verify the receipt

bash

# Replace 142 with your actual receipt ID from the step above
curl -s https://axiom-ai-19.polsia.app/api/receipts/142/verify | jq .

Response

{
  "receipt_id": 142,
  "skill_name": "echo",
  "timestamp": "2026-05-27T08:00:00.000Z",
  "source": "live",
  "caller": "quickstart-demo",
  "inputs_hash": "a1b2c3d4e5f6…",
  "output_hash":  "f6e5d4c3b2a1…",
  "signature_valid": true,
  "verification_status": "verified",
  "verified": true
}

verified: true means the HMAC-SHA256 signature is intact and the receipt was not an error receipt. You can also open it in a browser: axiom-ai-19.polsia.app/verify?id=142

One-liner (no account needed for demo)

⚡ The API works without authentication for initial testing. Add your Bearer token when you're ready to tag receipts as live production traffic.

bash

# Invoke + verify in one shell block (no API key required for demo)
RECEIPT=$(curl -s -X POST https://axiom-ai-19.polsia.app/api/receipts/invoke \
  -H "Content-Type: application/json" \
  -d '{"skill_name":"echo","inputs":{"message":"hello"},"caller":"quickstart-demo"}')

RECEIPT_ID=$(echo $RECEIPT | jq -r .receipt.id)
echo "Receipt ID: $RECEIPT_ID"

curl -s "https://axiom-ai-19.polsia.app/api/receipts/$RECEIPT_ID/verify" | jq '{verified,signature_valid,skill_name,timestamp}'

1 Get your API key

Pilot customers: your key was emailed when you signed up. Retrieve it at /account/billing.
Not a pilot yet? Sign up for the pilot program →

2 Download the bundle

📦 The bundle is a signed ZIP containing receipts.json, merkle-root.txt, bundle-signature.txt, verification.md, compliance-mapping.md, and manifest.json.

bash

curl -s \
  -H "Authorization: Bearer YOUR_API_KEY" \
  "https://axiom-ai-19.polsia.app/api/receipts/audit-bundle.zip?\
from=2026-05-01T00:00:00Z\
&to=2026-05-31T23:59:59Z\
&email=you@company.com" \
  --output axiom-audit-bundle.zip

# Verify the download
ls -lh axiom-audit-bundle.zip
unzip -l axiom-audit-bundle.zip

Output

-rw-r--r--  1 user  staff  14K May 27 18:00 axiom-audit-bundle.zip

Archive:  axiom-audit-bundle.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
   128456  05-27-2026 18:00   receipts.json
       65  05-27-2026 18:00   merkle-root.txt
       89  05-27-2026 18:00   bundle-signature.txt
     3421  05-27-2026 18:00   verification.md
     8192  05-27-2026 18:00   compliance-mapping.md
      312  05-27-2026 18:00   manifest.json

3 Verify the bundle signature

bash

# Extract manifest + bundle signature
unzip -p axiom-audit-bundle.zip manifest.json | jq .
unzip -p axiom-audit-bundle.zip merkle-root.txt

# Verify signature against Axiom's public verifier endpoint
MANIFEST=$(unzip -p axiom-audit-bundle.zip manifest.json)
BUNDLE_SIG=$(unzip -p axiom-audit-bundle.zip bundle-signature.txt | tr -d '\n')

curl -s -X POST https://axiom-ai-19.polsia.app/api/receipts/verify-bundle \
  -H "Content-Type: application/json" \
  -d "{
    \"customer_email\": $(echo $MANIFEST | jq .customer_email),
    \"from\":           $(echo $MANIFEST | jq .from),
    \"to\":             $(echo $MANIFEST | jq .to),
    \"merkle_root\":    $(echo $MANIFEST | jq .merkle_root),
    \"receipt_count\":  $(echo $MANIFEST | jq .receipt_count),
    \"bundle_signature\": \"$BUNDLE_SIG\"
  }" | jq .

Response

{
  "valid": true
}

"valid": true confirms the bundle was generated by Axiom and the Merkle root covers the receipt set without modification. Full instructions including how to re-derive each receipt signature are inside verification.md in the ZIP.

What's in the bundle

File	Contents
`receipts.json`	Array of every receipt (skill_name, timestamp, hashes, signature, receipt_id). Capped at 10,000.
`merkle-root.txt`	SHA-256 Merkle root over sorted receipt signatures. Single hex line.
`bundle-signature.txt`	HMAC-SHA256 of `email\|from\|to\|merkle_root\|count` using Axiom server secret. Base64.
`verification.md`	Step-by-step CLI instructions to re-derive signatures + Merkle root + verify bundle.
`compliance-mapping.md`	Maps bundle to EU AI Act Art 12 & 13, SOC 2 CC7.2/CC7.3, HIPAA §164.312(b), DORA Art 12.
`manifest.json`	customer_email, from, to, receipt_count, merkle_root, bundle_id, generated_at, axiom_version.

Download from the dashboard

🔐 You can also download audit bundles directly from /account/billing using the "Download audit bundle" section — no curl required.

Available skills

These are the skills available on the Axiom test server. Swap in your own MCP server to receipt-stamp real agent work.

Skill	Inputs	What it does
`echo`	`{ "message": "string" }`	Echoes back the message with a received_at timestamp
`hash`	`{ "data": "string" }`	Returns SHA-256 hash of the input data
`timestamp`	`{}`	Returns current UTC timestamp in ISO 8601
`ping`	`{}`	Returns `"pong"`
`db_query`	`{ "query": "SELECT …", "params": [] }`	PostgreSQL SELECT — rows, rowCount, executionTime. SELECT-only. Enterprise
`http_request`	`{ "url": "…", "method": "GET\|POST", "headers": {}, "body": {} }`	HTTP call — status, headers, body, latency (10s timeout). Enterprise

Enterprise skill example: db_query

Compliance use case — prove the agent queried the right customer record. SELECT-only for safety.

🔒 All write operations (INSERT, UPDATE, DELETE) are blocked at the MCP server level. The receipt proves the agent ran the exact SELECT it claimed.

bash

curl -s -X POST https://axiom-ai-19.polsia.app/api/receipts/invoke
  -H "Content-Type: application/json"
  -d '{
    "skill_name": "db_query",
    "inputs": {
      "query": "SELECT id, skill_name, timestamp FROM receipts ORDER BY id DESC LIMIT 5",
      "params": []
    },
    "caller": "compliance-audit"
  }' | jq '{receipt: {id, skill_name, inputs_hash, verification_status}, result: .result}'

Deeper reference

Full API docs including filtering, pagination, receipt schema, and wrapping your own MCP server.

docs/integration.md — Full API reference → Open-source verifier on GitHub →

Evaluating Axiom alongside Meridian, MintMCP, Vanta, or JFrog? See the honest competitive matrix →