Authentication

Bearer keys for the API, wallet sessions for the dashboard.

Start / authentication

The API takes a bearer key. The dashboard takes a signed-in wallet.

API keys

Send your key in the Authorization header. Keys start with sk-provn-.

bash

curl https://YOUR-PROVN-HOST/v1/keys/self \
  -H "Authorization: Bearer $PROVN_API_KEY"

Provn stores the SHA-256 hash of each secret and nothing else, so it can't show you a lost secret again. Revoke that key and create another.

Status	Type	Cause
401	`invalid_key`	The header is missing or the key is unknown.
403	`key_expired`	The key passed its expiry.
403	`key_revoked`	You revoked the key or its parent.

Endpoints without a key

GET /v1/status
GET /v1/signer
GET /v1/models
POST /v1/receipts/verify
GET /v1/receipts/:id (public receipts)
GET /v1/receipts/:id/proof
GET /v1/explorer/stats and GET /v1/explorer/recent
POST /v1/terminal/run
GET /v1/passports and GET /v1/passports/:handle
GET /v1/anchors

Dashboard sessions

The dashboard signs you in with an EVM wallet through Privy on Robinhood Chain (chain id 4663). After the wallet connects, you sign a SIWE (Sign-In with Ethereum) message and the server sets an httpOnly session cookie. Your wallet address is your account, and Provn has no email or password login.

Dashboard actions run on routes under /api/portal with that cookie: keys, usage export, receipt sharing, runs, deposits, plans, passports and the console.

Anyone holding a key can spend your balance up to that key's cap. Give each agent its own capped key and store secrets the way you store passwords.