Bring outside services into your app.

Optional automation. Your customer stays in control.

1. Approve a finite batch. Open the owner approval flow from your app with 1–32 exact inputs, one service, the payer, a spending cap and an expiry. The owner opts in once for that list; new inputs or wider limits need new permission.
2. Connect the customer’s runner. Use Node 24.15 or later on a trusted Linux or macOS customer host. Keep the admitted app credential and RSA key private, and use one persistent private directory and journal per program. The separate customer-controlled EIP-1193 signer authorizes each exact payment.
3. Run or recover. Pass one approved input to the SDK at a time. If its outcome is uncertain, recover the same input and original job. Reopening the same journal does not authorize a replacement payment.

A ready permission does not mean a runner is connected or a payment happened. Your app must connect the actual customer runner before showing execution as available. The SDK’s local status reports budget use; it is not a remote connectivity check.

Manual payments remain available. Unattended use requires a signer the customer has independently configured for it. Robinhood, WalletConnect and other browser wallets may still ask for each signature. Never send a wallet key or recovery phrase to Voidly.

import {
  createCustomerHostedProgramJobs,
  parseOwnerAppProgram,
} from '@voidly/session/customer-hosted';

const jobs = createCustomerHostedProgramJobs({
  directory: applicationPrivatePersistentDirectory,
  program: parseOwnerAppProgram(actualApprovedProgramFromVoidly),
  credential: {
    builderKey: admittedApplicationCredential,
    keyId: admittedApplicationKeyId,
    privateKey: applicationRsaPrivateKeyObject,
  },
  lifetime: currentApplicationAuthority, // { isCurrent, signal }
  provider: customerConfiguredSigner,
});

const outcome = await jobs.run({ selectedText: oneApprovedExactInput });
// A preflight refusal may have no original to recover.
if (outcome.kind !== 'refused') {
  const recovery = await jobs.recover(approvedInputSha256);
}

One job. The same identity through recovery.

1. Read the service. Use its published description, then check current account-specific readiness.
2. Review the scope. Show the provider, exact input, recipient, price, budget and expiry before approval.
3. Keep the original job. Persist its operation ID before submitting. After an uncertain response, recover that ID.
4. Read payment and result separately. A submitted request is not a confirmed payment or a delivered result.

Keep account credentials, signer setup and approval controls in the trusted app. Expose only the approved job and recovery operations to the agent. Voidpay does not hold customer funds or use escrow.