Delegation

Mint a sub-key bounded by the key that made it.

Govern / delegation

POST /v1/keys/delegate lets a key mint a sub-key, for example when an agent hands part of a task to a sub-agent. The sub-key can't be looser than its parent on cap, models or expiry.

bash

curl https://YOUR-PROVN-HOST/v1/keys/delegate \
  -H "Authorization: Bearer $PROVN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "research-subagent",
    "cap_usd": 0.25,
    "models": ["provn-nano"],
    "expires_in_s": 3600
  }'

Field	Required	Rule
`name`	yes	A label for the sub-key.
`cap_usd`	yes	At most the parent's remaining cap.
`models`	no	A subset of the parent's allowed models.
`expires_in_s`	no	Seconds until expiry. The result can't land after the parent's expiry.

The response contains the sub-key secret, and Provn shows it this one time. Provn refuses a request that would make the sub-key looser than its parent.

Revocation

Revoke a parent and Provn revokes its sub-keys with it. Calls on those sub-keys then get 403 key_revoked.