Guide: the approver network ("Sign in with Provenance")

Enroll a human once, with a passkey and a verified contact, and any integrator can route approvals to that person. This is the integrator side; the approver uses the portal.

The consent copy ships as clearly-labeled DRAFT pending counsel review, and the whole network can be paused instantly with the APPROVER_NETWORK kill-flag. See pricing for the per-approval price.

1. Invite a contact you already hold

There is no directory and no discovery — you can only invite an email or phone you already have for your own user.

curl $PROVENANCE_API/v1/approver-links \
  -H "Authorization: Bearer $PRV_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "contact": "user@example.com", "grant": { "max_amount": 1000 } }'

{ "link_id": "01J…", "status": "invited", "invite_url": "https://…/approver/invite/…" }

Invites are rate-capped per integrator, cool-down per target, and a recipient can one-tap block you permanently. Sending while the kill-flag is off returns 503.

2. The approver accepts

They open the invite, see exactly what you're granting (name, scope, policies) and the DRAFT consent, and accept with a passkey that belongs to them — not to you. The same passkey works across every integrator they connect with. You never see their email, phone, passkey, or their other links — only their display name and the outcome.

3. Route an approval

When your flow needs a human, route it to the link:

curl $PROVENANCE_API/v1/approver-links/$LINK_ID/approvals \
  -H "Authorization: Bearer $PRV_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "jti": "…", "action_description": "Wire $500 to vendor", "amount": 500 }'

The approver's tighten-only policy applies on top of your grant — they can add a biometric requirement, lower the amount ceiling, or set quiet hours, but never loosen what you asked for. The response shows the composed (tightened) requirements. The approver decides in their portal with a WebAuthn ceremony; resolution flows back through the normal approvals pipeline, a receipt records the approver distinctly, and you're metered network_approval_resolved (the approver never pays).

4. Revoke

Either side can revoke a link at any time. Pending requests on it expire immediately and future routing returns link_revoked.

curl -X DELETE $PROVENANCE_API/v1/approver-links/$LINK_ID \
  -H "Authorization: Bearer $PRV_KEY"