sesame request — Proxy an Authenticated HTTP Request

sesame request is the core command of the Sesame CLI — it replaces curl for any API call that requires authentication. Instead of embedding API keys in your shell history or environment variables, you send the request through the Sesame broker, which looks up the right credentials for the target hostname and injects the Authorization header server-side before forwarding the call.

Syntax

sesame request <METHOD> <URL> [flags]

Arguments and flags

string

required

The HTTP method to use. Accepts GET, POST, PUT, PATCH, DELETE, and any other valid HTTP verb.

string

required

The full URL of the API endpoint, including scheme and any query parameters.

sesame request GET "https://api.github.com/repos/acme/app/issues?state=open"

string

Add a request header. Use the same "Name: Value" syntax as curl. Repeat the flag to add multiple headers.

sesame request GET https://api.example.com -H "Accept: application/json" -H "X-Request-ID: abc123"

string

Request body data. Pass a raw string or use shell substitution to read from a file. Use with POST, PUT, and PATCH requests.

sesame request POST https://api.example.com/items -d '{"name":"widget"}'

flag

Output the raw response body without any formatting or colour highlighting. Useful for piping the response into other tools such as jq, grep, or a file.

sesame request GET https://api.example.com/data --raw | jq '.items[]'

Examples

sesame request GET \
  "https://api.github.com/repos/acme/my-app/issues?state=open" \
  -H "Accept: application/vnd.github+json"

sesame request POST https://api.anthropic.com/v1/messages \
  -H "Content-Type: application/json" \
  -H "anthropic-version: 2023-06-01" \
  -d '{
    "model": "claude-sonnet-4-5",
    "max_tokens": 1024,
    "messages": [
      {"role": "user", "content": "Summarise the attached document."}
    ]
  }'

sesame request POST https://api.stripe.com/v1/payment_intents \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "amount=2000&currency=usd&automatic_payment_methods[enabled]=true"

sesame request POST https://slack.com/api/chat.postMessage \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "C0123456789",
    "text": "Deployment to production completed successfully."
  }'

First-time approval for a new hostname

The first time you send a request to a hostname, the broker pauses and waits for you to approve it. You will receive an approval prompt in the Sesame app, the Sesame dashboard, or via your configured Telegram notification. Tap Approve to allow the request and establish the policy for that hostname. All subsequent requests to the same hostname use the cached policy and proceed without interruption.

How it works

When you run sesame request, the following happens in order:

The CLI attaches your JWT to the outbound call and sends it to the Sesame broker.
The broker verifies the JWT signature against your registered device public key.
The broker checks whether the target hostname has an active policy for your agent.
If this is the first request to that hostname, the broker blocks and sends you an approval prompt.
Once the policy check passes, the broker looks up the stored secret for that hostname and injects the Authorization header (or whichever auth header the provider requires).
The broker forwards the request to the target API and streams the response back to your CLI.

Your API keys are never exposed to the CLI, the agent process, or your shell environment.

Run sesame hostnames before starting an agent session to confirm the broker has credentials configured for every API your agent needs. Requests to unconfigured hostnames are rejected before they reach the provider.

Get Started

CLI Reference

Agent Skills

Connect an Agent

Security & Privacy

Integrations

sesame request — Proxy an Authenticated HTTP Request

Syntax

Arguments and flags

Examples

First-time approval for a new hostname

How it works

​Syntax

​Arguments and flags

​Examples

​First-time approval for a new hostname

​How it works

Syntax

Arguments and flags

Examples

First-time approval for a new hostname

How it works