API keys
Create keys, cap their spend, limit their models and revoke them.
Govern / api-keys
Create keys in the dashboard. Provn shows the secret once and stores its SHA-256 hash, so put the secret in your secret manager before you close the dialog.
Controls
| Control | Behavior |
|---|---|
| Spend cap | A USD limit over a total, day or month window. At the cap, calls get 402 cap_reached and Provn makes no upstream call. |
| Model allowlist | The models the key may call. Others get 403 model_not_allowed. |
| Expiry | After this time, calls get 403 key_expired. |
| Rate limit | Requests per minute for this key, at or below your plan's limit. |
| Revoke | Stops the key and each sub-key minted from it. Calls get 403 key_revoked. |
You can edit a key's cap after you create it.
Keys per plan
| Plan | Keys |
|---|---|
| Free | 5 |
| Pro | 50 |
| Scale | 250 |
Read your own key
GET /v1/keys/self returns the calling key's limits and spend. An agent can check its headroom before it starts an expensive step.
bash
curl https://YOUR-PROVN-HOST/v1/keys/self \
-H "Authorization: Bearer $PROVN_API_KEY"Give each agent its own key with its own cap. A loop that goes wrong then stops at that key's cap and leaves the rest of your balance alone.