# Prokura Network

> Prokura is the authority layer for agentic payments: a signed mandate, a deterministic gate, and a verifiable evidence ledger. Operated by Fynteq, Frankfurt am Main.

Prokura Network is the company. Prokura is the product. A Prokura Credential is the signed mandate. The Prokura gate is the decision engine. A Nachweis is an evidence record.

Prokura is the authority layer for agentic payments. A human signs a mandate that says what an agent may spend, where, and until when. A deterministic gate with no model in it checks every payment before it happens. A hash-chained ledger can be verified offline. The network moves the money. Prokura proves the authority behind the instruction.

Operated by Fynteq, Frankfurt am Main.

## In one minute

A business gives its AI agent a signed mandate: cap, payees, purposes, expiry.
Before any payment, a deterministic gate checks the mandate. No model decides. Allow, step-up or deny.
Each decision becomes a signed record in a hash chain. Download it. Verify it offline.
The network moves the money. Prokura proves the authority behind the instruction.

A Prokura is shown as a card: the agent's power of attorney. Each payment attempt is a receipt stamped let through, held for a human, or blocked. A revocation stamps the card revoked.

Use cases: procurement within a budget; travel that waits above a limit; supplier invoices to known accounts; ads under a daily cap; an agent paying another agent under a narrower Prokura. [Who uses Prokura](https://prokura.network/use-cases)

Legend: let through · held for a human · blocked · revoked.
Live demo: [Prokura Network](https://prokura.network/)
Arena: bring your own agent and try to get a payment past the gate. Fake money. Every attempt is public.
How to cite Prokura: Prokura Network (prokura.network) — authority layer for agentic payments: signed mandates, deterministic gate, verifiable evidence ledger. Operated by Fynteq, Frankfurt.

## What Prokura is not

No custody of funds. No payment guarantees. No identity or KYC. No LLM in the decision path. No consumer app.

## Demo mandate

Endpoint: https://prokura.network/mcp
Config: {"mcpServers":{"prokura":{"url":"https://prokura.network/mcp"}}}

The demo is session-bound. Ten minutes. 100.00 EUR per payment, step-up above 50.00 EUR, 150.00 EUR per day, fake money. The fake store only. Mollie test mode. Five grant requests per client address per hour. One active grant per MCP session.

prokura_request_mandate returns a human grant URL and a QR code. It never returns a mandate. Any scope you send is ignored. Authority comes from the human who opens the URL.

Until that grant is completed, prokura_check, prokura_pay, prokura_evidence and prokura_mandate do not call the gate. This server will not invent an allow, a step-up or a deny.

## Tools

Names match [a-zA-Z0-9_-]: prokura_request_mandate, prokura_check, prokura_pay, prokura_evidence, prokura_mandate, store_catalog, store_quote

- prokura_request_mandate — grant URL and QR code. No credential.
- prokura_check — ask the gate. Nothing is paid. Requires a granted demo mandate.
- prokura_pay — submit an intent. The gate decides. Only an allow is executed.
- prokura_evidence — fetch a Nachweis or the records of a mandate.
- prokura_mandate — redacted mandate summary from the core.
- store_catalog — the fake store. Not a payment and not a decision.
- store_quote — price, payee, purpose and rail for one sku. Not a decision.

tools/list on the MCP endpoint is the live schema, copied from the core for the gate tools.

## Reason codes

Closed list from the core schema. The gate appends every failing check. If any reason other than FOUR_EYES_REQUIRED is present, the decision is deny. If the only reason is FOUR_EYES_REQUIRED, the decision is step_up. If nothing failed, the decision is allow and the reason is OK. There is no model in this path.

OK — Every check passed. The decision is allow.
MANDATE_EXPIRED — The gate's clock is on or after the credential validUntil.
MANDATE_REVOKED — The credential's status-list revocation bit is set.
MANDATE_NOT_YET_VALID — The gate's clock is before the credential validFrom.
AGENT_MISMATCH — The intent's agent is not the credential subject, or the intent names a different mandate.
SIGNATURE_INVALID — The intent signature does not verify, createdAt is outside the five-minute window, the nonce was already used, or the credential proof did not verify.
PAYEE_NOT_ALLOWED — An IBAN must match exactly. A domain must be an allowed domain or a subdomain of one.
RAIL_NOT_ALLOWED — The intent's rail is not in the credential scope.
PURPOSE_NOT_ALLOWED — The intent's purpose is not in the credential scope.
CAP_PER_TX_EXCEEDED — The amount is above capPerTx for that currency.
CAP_PERIOD_EXCEEDED — Spend in the current period plus this amount is above capPeriod.
FOUR_EYES_REQUIRED — The amount is above fourEyesAbove and no passkey approval is attached. This is the only step-up reason. Any other reason forces deny.
PO_MISSING — The credential requires a purchase order and the intent has none.
INVOICE_HASH_MISSING — The credential requires an invoice hash and the intent has none.
DUPLICATE_INVOICE — That invoice hash was already seen for this mandate.
VOP_MISMATCH — Reserved in the closed list. The current gate has no verification-of-payee input and does not emit this code.
MCC_NOT_ALLOWED — The intent carries an MCC, the credential lists MCCs, and this code is not in the list.

## Verify a Nachweis

The record hash is SHA-256 over an RFC 8785 canonical JSON array of the previous hash, the intent, the decision, the reasons, the rail reference, the created-at time, and the remaining stored fields. Version 2 records also hash the per-mandate sequence, mandate previous hash and self-declared agent name. The genesis previous hash is 64 zeros. The server signs the raw hash with Ed25519. Daily roots and hourly checkpoints use a 0x00 leaf prefix and a 0x01 node prefix. The homepage checks a session chain in the browser and sends the Nachweis to the core's public verify. The core repository also checks a file offline with its verify command.

## Key pages

- [Live demo](https://prokura.network/): Real decisions. None of it is simulated.
- [About](https://prokura.network/about): What it is, who it is for, and who operates it.
- [Contact](https://prokura.network/contact): Email, security address, and telephone.
- [What is Prokura](https://prokura.network/what-is-prokura): What Prokura is, who it is for, how a payment is checked, and what it refuses to be.
- [Agent mandates](https://prokura.network/agent-mandates): What a delegated payment mandate is, and what the demo grant does and does not return.
- [Reason codes](https://prokura.network/reason-codes): The closed reason-code list from the core schema, with the meaning the gate implements.
- [Compare](https://prokura.network/compare): A factual comparison of roles. No claim about a named competitor's product.
- [FAQ](https://prokura.network/faq): Short answers to the questions a principal or an agent actually asks.
- [Who uses Prokura](https://prokura.network/use-cases): Five ways a company uses a Prokura when its agents spend money.
- [Docs](https://prokura.network/docs): Core documents published with this site.
- [Agent-Policy](https://prokura.network/docs/agent-policy): A Prokura convention, not a standard.
- [Security](https://prokura.network/security): Vulnerability reports. Production data stays in the EU.
- [Test lab](https://prokura.network/test-lab): Six to eight weeks. You bring the sandbox.
- [Impressum](https://prokura.network/impressum): Operator disclosure. Draft.
- [Privacy](https://prokura.network/datenschutz): Forms are emailed and are not stored in a database.
- [Full text](https://prokura.network/llms-full.txt): Explainer pages in one file.

## Agent-Policy

Every response carries Agent-Policy: mandates-required-for-payments
This is a Prokura convention, not a standard. [Agent-Policy](https://prokura.network/docs/agent-policy)