# Set up two-party approvals

Require approval by designated reviewers before sensitive actions take effect.

With approval rules, administrators can conditionally require two-party approval for sensitive actions in your account.

When an action triggers an approval rule, the action is interrupted and an approval request is created. A designated reviewer approves or denies the request. Approved actions are completed automatically; denied actions are discarded with no changes made.

### Request to join the preview for two-party approvals.

Enter your email to request access.

```bash
curl https://docs.stripe.com/preview/register \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Referer: https://docs.stripe.com/account/approvals" \
  -d '{"email": "EMAIL", "preview": "approvals_product_preview"}'
```

## Supported actions 

You can require approval for the following actions:

- Bank account is added, updated or deleted
- Admin is invited to account
- Payment intent is created
- Invoice is created
- Refund is created
- Subscription is created or canceled
- Credit note is created
- Customer balance transaction is created
- Outbound payment is created
- Outbound transfer is created
- Inbound transfer is created
- Payout is created
- Currency conversion is created
- Approval rule is created, updated or deleted

## Create an approval rule 

1. Go to **Settings** > [Approvals](https://dashboard.stripe.com/settings/approvals/rules).
2. Click **Create rule**, then select the action that triggers the approval. By default, only team members with the Administrator role can create or edit approval rules. You can optionally create a rule to require designated reviewers for creating or updating approval rules.
3. (Optional) Click **Add condition** to add one or more trigger conditions. If you add multiple conditions, you can combine them with `and` or `or`. For example:
   - **Amount condition**: Require approval for a refund only if the amount exceeds a threshold.
   - **Actor condition**: Require approval for actions taken by team members or [agent-tagged API keys](https://docs.stripe.com/keys.md#agent-keys).
4. Set the control:
   - **Require approval**: The action is paused until a reviewer approves it.
   - **Block**: The action is rejected outright.
5. Choose **designated reviewers**: individual team members, or all team members with an assigned role, such as Administrator, Analyst, or Support specialist. Only individually assigned team members receive email notifications when an action requires their review.
6. Optionally, define **custom justification instructions** for requesters that appear when they request a sensitive action, so they can submit proper justification.
7. Optionally, enter a **name** for the rule.
8. Click **Activate** to save and enable the rule immediately, or **Save changes** to save it as inactive.

You can activate, deactivate, or delete rules at any time from the Approvals settings page. Only one active rule can apply to a given action.

## Review approval requests 

Designated reviewers can approve or deny requests in the Dashboard under **Settings** > **Approvals** > [Requests](https://dashboard.stripe.com/settings/approvals/requests). Use the filters to view requests by status, then click a request to view its details and respond. Requests that haven’t been approved within 14 days expire automatically.

When a request is approved, the action completes automatically. When denied, no changes are made. A user can’t approve their own request.

## Default rules for agent-tagged API keys

Stripe maintains default approval rules for the following sensitive actions taken by [agent-tagged API keys](https://docs.stripe.com/keys.md#agent-keys):

- Refund is created
- Subscription is canceled
- Outbound payment is initiated
- Outbound transfer is initiated
- Inbound transfer is initiated
- Payout is created
- Currency conversion is created

You can modify conditions or designated reviewers for default rules, or delete them in the [Approvals settings](https://dashboard.stripe.com/settings/approvals/rules).

## Handle API requests from agent-tagged API keys that require approval 

When an agent-tagged API key attempts an action that triggers an approval rule, Stripe returns an `approval_required` error and automatically submits an approval request for review.

### Add a justification

To programmatically attach a justification, update the approval request:

```curl
curl -X POST https://api.stripe.com/v2/core/approval_requests/apreq_1R4kXn2eZvKYlo2C/update \
  -H "Authorization: Bearer <<YOUR_SECRET_KEY>>" \
  -H "Stripe-Version: 2026-07-29.preview" \
  --json '{
    "reason": "Customer support request for Jenny Rosen"
  }'
```

## Monitor approval activity 

Approval events appear in [Security history](https://dashboard.stripe.com/settings/security_history) under **Settings** > **Team and security**. The following events are logged:

- Approval rule created, updated, activated, deactivated, or deleted
- Approval request created, approved or denied

You can also view API requests where approval was required from [Logs in Workbench](https://dashboard.stripe.com/workbench/logs). Click an API request to view it.

## Webhooks and events 

Approval requests are reviewed asynchronously. Listen for these events to handle outcomes in your integration.

| Event | Description |
| --- | --- |
| `v2.core.approval_request.created` | An approval request was created |
| `v2.core.approval_request.approved` | A reviewer approved the request |
| `v2.core.approval_request.rejected` | A reviewer denied the request |
| `v2.core.approval_request.canceled` | The request was canceled |
| `v2.core.approval_request.expired` | The request expired after 14 days |
| `v2.core.approval_request.succeeded` | The approved action completed successfully |
| `v2.core.approval_request.failed` | The approved action failed to execute |

## Accounts with a single team member

Two-party approval requires the approver to be different from the requestor. On single-user accounts, you can only save two-party approval rules where the actor condition is set to `agent-tagged API keys`, because an agent API key is an independent actor from the administrator of the account.

## See also

- [API keys](https://docs.stripe.com/keys.md)
- [User roles](https://docs.stripe.com/get-started/account/teams/roles.md)