Provenance
Read the docs
Authorize

AP2 proves agent→agent trust.
Authorize proves a human started the chain.

An intent token binds a real, present human to a hash of exactly what an AI agent is about to do. It sits beneath Google’s AP2 payments protocol.

Join the betaRead the guide

Authorize, then verify

The token carries a hash of the action description and, optionally, of the exact machine payload the agent will execute, such as an AP2 mandate. At verify time the agent presents the same payload. If it changed after approval, verification fails with payload_hash_mismatch.

cURL
curl https://api.provenanceauth.com/v1/intent/authorize \
  -H "Authorization: Bearer prv_test_full_..." \
  -d '{
    "action_description": "Transfer $1,850 to acct ****4021",
    "agent_session_id": "sess_abc",
    "biometric_present": true,
    "device_id": "00000000-0000-0000-0000-000000000001"
  }'

{ "intent_token": "eyJhbGciOiJFUzI1NiJ9…", "expires_at": "…" }

One flow for any action

The same authorize and verify calls work for any action an agent can take: a payment, a deletion or an access grant.

A payment

"Transfer $1,850 to acct ****4021"

A record deletion

"Delete all customer records tagged churned"

An access grant

"Grant contractor@example.com write access to the finance drive"

identical authorize → verify code for all three