Chat completions
LiveThe OpenAI chat request shape at a new base URL. Swap the URL and key in your client and keep the rest of your code.
POST /v1/chat/completions/docs/chat-completionsSix things you do with Provn
One gateway, one balance, one receipt format, sorted by the job in front of you. Each feature shows its real status, so you can tell what runs today from what is still a plan.
48 features · 31 live on this deployment
Live
Built, and working on a Provn deployment with no extra settings.
Config-gated
Built and tested, but off until the operator sets the environment variable or funds the account the entry names.
Planned
Not built. Provn lists it so you can see the direction, and describes it as available only after it ships.
Compute
Inference and JavaScript execution behind one OpenAI-compatible gateway, metered per unit at the gateway.
Run · 6 of 9 live
Streaming
LiveServer-sent events with stream set to true. The signed receipt arrives as a provn.receipt event, the last one before [DONE].
Models
Liveprovn runs on gpt-oss-20b and provn-nano on gpt-5.4-nano, both through a free public upstream. Each receipt names the engine that served the call.
GET /v1/models/modelsSandboxes
LiveRun JavaScript in QuickJS compiled to WebAssembly, with a timeout of up to 5,000 ms. You pay per CPU millisecond from the same balance as chat.
POST /v1/sandboxes/docs/sandboxesTerminal
LiveRun JavaScript with no account and get a signed public receipt back. Provn pays for these runs and allows 12 per IP every 10 minutes.
POST /v1/terminal/run/terminalConsole
LiveSend chat and sandbox calls from the dashboard on one of your own keys, and read each receipt as it comes back.
Custom upstream
Config-gatedExtra models appear once an operator sets PROVN_UPSTREAM_BASE_URL and PROVN_UPSTREAM_API_KEY for an OpenAI-compatible provider. That provider sees prompts in plaintext.
Embeddings
PlannedVector embeddings on the same metering and receipt path as chat.
Image and video generation
PlannedGenerated media, metered per output and receipted like any other call.
Agents
The parts an agent needs around a model call. Run tracking and key introspection ship today. Provn has not built the rest of this group yet.
Build · 2 of 7 live
Runs
LiveStart a run, send its id in the x-provn-run header, and each receipt your agent collects joins one hash chain.
POST /v1/runs/docs/runs-and-audit-packsKey introspection
LiveAn agent reads its own key's limits and spend before it commits to an expensive step.
GET /v1/keys/self/docs/api-keysHosted agents
PlannedDeploy agent code and have Provn run it on a schedule under its own capped key.
Memory and RAG
PlannedMetered knowledge bases your agent can store to and search from a chat call.
Evals
PlannedTest suites that score a model and flag a pass rate that drops between runs.
MCP server and gateway
PlannedProvn tools over MCP, and third-party MCP servers placed behind Provn caps and receipts.
Service directory and x402 payments
PlannedA listing where one agent publishes a service and another calls it and pays per request.
Control
Budgets and limits the gateway checks on each request, before any call goes upstream.
Govern · 6 of 9 live
API keys
LiveCreate keys in the dashboard. Provn shows the secret once and stores its SHA-256 hash.
Spend caps
LiveGive a key a USD cap over a total, daily or monthly window. At the cap it gets HTTP 402 cap_reached and Provn makes no upstream call.
Model allowlists and expiry
LiveLimit a key to named models and give it an end date. A call to any other model gets 403 model_not_allowed.
Delegation
LiveA key mints a sub-key with a cap, model list and expiry inside its own. Revoke the parent and Provn revokes its sub-keys too.
POST /v1/keys/delegate/docs/delegationRate limits
LiveA per-minute request limit on each key, up to 60 on Free, 600 on Pro and 1,500 on Scale.
Usage export
LiveYour metered usage in the dashboard with a CSV download. History covers 7, 90 or 365 days depending on plan.
Team seats
PlannedSeveral people on one balance, each with bounded authority.
Webhooks
PlannedSigned event delivery to your endpoint, including one event per receipt.
Observability export
PlannedMetrics and traces sent to a collector you already run.
Proof
Each metered call returns a signed receipt you can check without trusting Provn. Receipts chain into runs, and batches can anchor to Robinhood Chain.
Prove · 8 of 10 live
Signed receipts
LiveA content-free JSON payload signed with secp256k1 under EIP-191, sent in response headers or as the last stream event.
POST /v1/receipts/verify/docs/receiptsSigner address
LiveThe gateway publishes the address that signs receipts. Pin it once and verify offline from then on.
GET /v1/signer/docs/verificationBrowser verification
LivePaste a receipt and its signature, and the page recovers the signer address inside your browser.
Hash-chained runs
LiveEach receipt in a run carries the SHA-256 of the payload before it, so a missing or reordered receipt breaks the chain.
GET /v1/runs/:id/docs/runs-and-audit-packsAudit packs
LiveA signed export of a whole run with each receipt and signature, the head hash and the span. Included with Pro and Scale.
POST /v1/runs/:id/audit/docs/runs-and-audit-packsPublic anchoring
Config-gatedProvn hashes receipts into a Merkle tree and writes the root to Robinhood Chain. Without a funded PROVN_ANCHOR_KEY, Provn still seals each batch and labels it unanchored.
GET /v1/receipts/:id/proof/docs/anchoringAgent passports
LiveAn opt-in public handle with facts from your own receipts and runs, signed by the gateway. It carries no score.
GET /v1/passports/:handle/agentsExplorer
LiveAll-time counts of receipts, anchors, passports and runs, the last 24 hours of metering, and recent public artifacts.
GET /v1/explorer/stats/explorerGateway status
LiveStore latency, signer, upstream reachability, anchoring and Terminal state. Uptime reads null until the gateway has enough probe samples.
GET /v1/statusPublic benchmark arena
PlannedA leaderboard where each score comes from a receipted run anyone can repeat.
Privacy
Provn keeps metadata and drops content. Your prompts, completions and code stay out of storage and logs on every plan.
Seal · 5 of 7 live
Privacy contract
LiveThe gateway writes no prompts, completions or submitted code to storage or logs. It keeps model, units, cost, timestamps, key id, fingerprint and status.
Content fingerprints
LiveReceipts carry 16 hex characters of a SHA-256 over your request. You can match a request you still hold, and the fingerprint alone reveals nothing of the text.
Private receipts
LiveYour receipts stay private until you share one from the dashboard. Terminal receipts are public from the start.
GET /v1/receipts/:id/dashboardRetention by plan
LiveProvn trims usage history after 7 days on Free, 90 on Pro and 365 on Scale.
Standard tier disclosure
LiveEach model runs on the standard tier, where the upstream host processes your prompt in plaintext. Provn has no confidential tier today.
Confidential execution
PlannedHardware-attested (TEE) execution where the host cannot read the prompt.
Region pinning
PlannedPin a request to a declared region, or have the gateway refuse it.
Balance
One prepaid balance tied to the wallet you sign in with, funded with ETH on Robinhood Chain.
Hold · 4 of 6 live
Wallet sign-in
LiveConnect an EVM wallet through Privy on chain 4663 and sign a SIWE message. Your wallet address is your account.
Signup credit
LiveA new account starts with a one-time $1.00 credit.
ETH deposits
Config-gatedSend ETH on Robinhood Chain to the treasury and paste the hash, and the gateway checks the transaction and credits USD at the ETH/USD rate. Off until PROVN_TREASURY_ADDRESS is set.
Balance ledger
LiveAn append-only ledger in micro-USD. The cost printed on a receipt is the amount the ledger debits.
Plans
LiveFree, Pro at $29 and Scale at $99 a month, paid from your balance. Plans raise limits and retention while compute prices stay the same.
Real-world asset vault
PlannedA private registry for real-world assets with hash-chained entries.
What a status does not claim
A status tells you whether a feature is available today and nothing more. Live means the endpoint answers. It does not make the standard tier confidential, since the model host still reads your prompt, and a signed receipt shows that the gateway metered and signed a call without vouching for the answer. No third-party operators serve Provn traffic, and Provn runs no marketplace. The trust page lists each limit in full.