The system of record for fintech wallets, payouts, marketplaces and billing — with spending limits that keep AI agents in check and an audit trail you can prove.
Open-source core·Managed with LedgerForge Cloud
Payments used to start with a person pressing a button. Increasingly they start with schedulers, workflows and AI agents acting for a customer. The system of record under those flows has to be exact, enforce its own limits and leave evidence anyone can verify.
An agent can submit a thousand requests before anyone reads the first alert. Limits have to hold at the moment of posting, not in a report the next morning.
LedgerForgePer-key policies are checked and reserved in PostgreSQL before any transaction executes.
Agents spawn sub-agents and services mint their own keys. Every new credential becomes a new allowance unless budgets are inherited and shared.
LedgerForgeDelegated keys inherit their parent's restrictions and draw on the same daily budget.
When a payout is disputed, "the database says so" isn't proof. Finance, auditors and partners need records they can check independently.
LedgerForgeReplay verification and exportable hash-chain checkpoints you can anchor outside the database.
Customer and merchant balances that stay exact under retries, holds and refunds.
Reserve funds before the rail confirms, settle exactly what was paid, release the rest.
Split each order between sellers, fees and your platform, conserving every unit.
Meter usage in exact units, even when the price is a fraction of a cent.
Spending limits, shared budgets and independent approvals that the server enforces.
Calls the HTTP API, embeds the Go library or uses the local MCP server.
X-LedgerForge-KeyChecked against PostgreSQL for scope, expiry and revocation on every request.
scopes · expiry · ownerThe key's spending policy is applied and capacity reserved. Above the threshold, funds are held for approval.
policy · reservation · holdSource debited and destination credited by the same integer amount. Workers handle queued and scheduled work.
QUEUED → APPLIEDWith the hash chain enabled, postings are sealed into versioned hashes and checkpoints you can export and verify.
v3 chain · checkpointsHMAC-SHA256 over timestamp and raw body, sent to validated destinations.
audit export prints checkpoint roots to sign and store outside the database.
Integer postings with an explicit precision. Inputs that can't be represented exactly are rejected before posting, and split allocation conserves every unit.
Learn moreledgerforge verify replays balances from their postings. A versioned hash chain and exportable checkpoints let you prove history wasn't rewritten.
Learn morePer-key currency rules, transaction caps, UTC daily budgets shared by delegated keys, and approval holds that only an independent key can decide.
Learn moreKeys only delegate what they hold, revocation is checked against PostgreSQL, backend errors are sanitised and outbound webhooks are signed.
Learn moreJSON over HTTP with scoped keys in X-LedgerForge-Key.
Embed the ledger in a Go service with the same rules.
A local stdio server for agents, bound to one API key.
12.50 USD as 1250 integer units. skip_queue waits for the posting.
{ "source": "bln_e0f81b15-bd0a-43c5-9e84-7fd4394192e8", "destination": "bln_df56a248-7d7e-4c0c-8fbf-a5215c87b603", "currency": "USD", "precise_amount": 1250, "precision": 100, "reference": "order-1042", "description": "Order 1042", "skip_queue": true, "allow_overdraft": true, "overdraft_limit": 12.5}{ "rate": 0, "precise_amount": 1250, "amount": 12.5, "amount_string": "12.5", "precision": 100, "overdraft_limit": 12.5, "transaction_id": "txn_c493a7e3-ac39-4456-90c3-ac43f00c5e0d", "parent_transaction": "", "source": "bln_e0f81b15-bd0a-43c5-9e84-7fd4394192e8", "destination": "bln_df56a248-7d7e-4c0c-8fbf-a5215c87b603", "reference": "order-1042", "currency": "USD", "description": "Order 1042", "status": "APPLIED", "hash": "9b7d7ad924e2e626055e3b33edcf194142e3fcd562de1807dd738d9afd7c1f87", "allow_overdraft": true, "inflight": false, "skip_queue": true, "atomic": false, "created_at": "2026-10-10T05:54:45.691597464Z", "effective_date": "2026-10-10T05:54:45.691597464Z", "scheduled_for": "0001-01-01T00:00:00Z", "inflight_expiry_date": "0001-01-01T00:00:00Z", "inflight_commit_date": "0001-01-01T00:00:00Z", "meta_data": { "allow_overdraft": true }}The same reference again is refused, and the source balance is unchanged at version 2.
{ "error": "reference has already been used", "error_detail": { "code": "TXN_DUPLICATE_REFERENCE", "message": "reference has already been used" }}{ "currency_multiplier": 0, "balance": -1250, "version": 2, "inflight_balance": 0, "credit_balance": 0, "inflight_credit_balance": 0, "debit_balance": 1250, "inflight_debit_balance": 0, "ledger_id": "ldg_e04e431f-8a27-4b19-8744-eb1867ed7b23", "identity_id": "", "balance_id": "bln_e0f81b15-bd0a-43c5-9e84-7fd4394192e8", "currency": "USD", "created_at": "2026-10-10T05:54:45.686498Z", "inflight_expires_at": "0001-01-01T00:00:00Z", "meta_data": null, "track_fund_lineage": false, "allocation_strategy": "FIFO"}A policy for an agent key, and the capacity it has left after one 30.00 payout.
{ "rules": [ { "currency": "USD", "precision": 100, "max_transaction": "5000", "daily_limit": "10000", "approval_above": "2000" } ], "ledger_ids": [ "ldg_e04e431f-8a27-4b19-8744-eb1867ed7b23" ], "balance_ids": [ "bln_df56a248-7d7e-4c0c-8fbf-a5215c87b603", "bln_173d086e-57cb-4690-9abe-1cf060fafb13" ]}{ "capacity": [ { "budgets": [ { "api_key_id": "api_key_8224a822-7ec0-4e0e-8f8f-d95039fc8fb3", "used_minor": "3000", "daily_limit": "10000" } ], "currency": "USD", "precision": 100, "day": "2026-10-10T00:00:00Z", "used_minor": "3000", "remaining_minor": "7000" } ], "policy": { "api_key_id": "api_key_8224a822-7ec0-4e0e-8f8f-d95039fc8fb3", "version": 1, "rules": [ { "currency": "USD", "precision": 100, "max_transaction": "5000", "daily_limit": "10000", "approval_above": "2000" } ], "ledger_ids": [ "ldg_e04e431f-8a27-4b19-8744-eb1867ed7b23" ], "balance_ids": [ "bln_df56a248-7d7e-4c0c-8fbf-a5215c87b603", "bln_173d086e-57cb-4690-9abe-1cf060fafb13" ] }}Above approval_above the payout is held; a separate approver key settles it.
{ "precise_amount": 3000, "precision": 100, "transaction_id": "txn_1a536530-f07d-43a5-8f72-c89965d179cd", "reference": "payout-2207", "status": "INFLIGHT", "inflight": true, "meta_data": { "policy_admission_id": "adm_dbebd5ed-78e0-40ce-a4a2-ab598a95e254", "policy_approval": "pending" }}{ "admission_id": "adm_dbebd5ed-78e0-40ce-a4a2-ab598a95e254", "api_key_id": "api_key_8224a822-7ec0-4e0e-8f8f-d95039fc8fb3", "identity": "payout-2207", "policy_version": 1, "day": "2026-10-10T00:00:00Z", "decision": "approved", "decided_by": "api_key_02790ec7-4f42-462b-8044-a0df92c70086", "legs": [ { "transaction_id": "txn_1a536530-f07d-43a5-8f72-c89965d179cd", "reference": "payout-2207", "source": "bln_df56a248-7d7e-4c0c-8fbf-a5215c87b603", "destination": "bln_173d086e-57cb-4690-9abe-1cf060fafb13", "source_ledger": "ldg_e04e431f-8a27-4b19-8744-eb1867ed7b23", "destination_ledger": "ldg_e04e431f-8a27-4b19-8744-eb1867ed7b23", "currency": "USD", "precision": 100, "amount": "3000" } ]}Replay balances, check the chain and compare it with checkpoints you exported earlier.
$ ledgerforge verifyChecked 6 balances and 4 transactions: 0 issues$ ledgerforge audit verifyChain: 4 sealed, head ff10247395ae53c4580005ac9c6cfb6cc7f79cbf5aeed252850e619b82ea2821, 0 pending, 0 tampering findings$ ledgerforge audit export > checkpoints.json$ ledgerforge audit verify --anchor checkpoints.json --json{"verified":true,"last_sequence":4,"head_hash":"ff10247395ae53c4580005ac9c6cfb6cc7f79cbf5aeed252850e619b82ea2821","pending":0,"tampering":[]}[ { "sequence": 1, "count": 1, "head_hash": "9f52ae4fe574506a5dbbc60fa563764579e97c3a818e6bb84f9ffc43ef53d081", "created_at": "2026-10-10T05:49:54.31577Z" }, { "sequence": 3, "count": 3, "head_hash": "3e859daaffd0aefeb952ad9d9f00f154d64f82f8e4d6ad0cbb3c80f5baca73ae", "created_at": "2026-10-10T05:49:59.315556Z" }, { "sequence": 4, "count": 4, "head_hash": "ff10247395ae53c4580005ac9c6cfb6cc7f79cbf5aeed252850e619b82ea2821", "created_at": "2026-10-10T05:50:09.315605Z" }]Today: managed LedgerForge deployments, operated by our team for each customer on dedicated infrastructure. You integrate against the API; we run the ledger, keep it current and check that it is intact.
For institutions that need LedgerForge inside their own perimeter, with commitments agreed in a contract.
Every line of the core is public and auditable.
Each release ships SPDX SBOMs, checksums and image provenance attestations.
Reachable vulnerabilities block publication.
Revocation is checked against PostgreSQL, not a cache.
Backend details stay in logs; deliveries are HMAC-signed.
Report issues to security@ledgerforge.io.
Start with the open-source core, or let the LedgerForge team run it for you on dedicated infrastructure.