Verify a track. One file.

01 · Core flow

Upload, then verify

Keep the API key in a server-side secret manager. Ask for a short-lived upload slot, post every returned form field plus the WAV, then verify with only the upload ID.

import { readFile } from "node:fs/promises";
import { PoHClient } from "@proof-of-human/ts-sdk";

const chronatum = new PoHClient({ apiKey: process.env.CHRONATUM_API_KEY! });
const upload = await chronatum.createUpload();

const bytes = await readFile("credentialed-song.wav");
const form = new FormData();
for (const [key, value] of Object.entries(upload.fields)) form.append(key, value);
form.append("file", new Blob([new Uint8Array(bytes)], { type: "audio/wav" }), "credentialed-song.wav");

const posted = await fetch(upload.url, { method: "POST", body: form });
if (!posted.ok) throw new Error(`upload failed: ${posted.status}`);

const result = await chronatum.verify({ uploadId: upload.uploadId });
if (!result.good || result.verdict !== "valid") {
  throw new Error(`proof rejected: ${result.verdict}`);
}

Legacy fallback: base64 the separate .poh and call verify({ uploadId, poh }). One-file delivery is currently WAV/BWF, up to 65 MiB in a verification slot. AIFF, CAF, MP3, and M4A keep using the legacy pair.

02 · Decision

Branch on the verdict

03 · Reviews

Track your review, keep your evidence

When a track lands in needs_review, the review workflow binds a registered proof to your own catalog identifiers and tracks the back-and-forth to your Accept / Hold / Reject outcome. Chronatum stores workflow state and bounded opaque references only — never source files, licences, creator names, or free-form notes — and review metadata expires automatically after 180 days. The outcome is your policy result, not a Chronatum claim of authorship.

const review = await chronatum.partner.createReview({
  proofId,
  bindings: { creatorId, accountId, submissionId, trackId }, // your opaque ids — never names/emails
});

// Ask the artist's side for source evidence, a licence, or clarification…
await chronatum.partner.requestEvidence(review.reviewId, { kind: "source_evidence" });
// …record the response reference from your own evidence system, then close it out:
await chronatum.partner.updateEvidence(review.reviewId, requestId, {
  status: "accepted",
  responseReference: "EVID-4821",
});
await chronatum.partner.resolveReview(review.reviewId, { outcome: "accepted" });

04 · Operations

Monitor without copying proof data

Capture status, latency, request ID, and rate-limit headers in your existing APM. Never log the key, audio, proof, presigned form fields, request URL containing a proof ID, or full response body.

const monitoredFetch: typeof fetch = async (input, init) => {
  const started = performance.now();
  const response = await fetch(input, init);
  yourApm.record("chronatum.api", {
    status: response.status,
    latencyMs: Math.round(performance.now() - started),
    requestId: response.headers.get("x-request-id"),
    quotaRemaining: response.headers.get("x-ratelimit-remaining"),
    retryAfter: response.headers.get("retry-after"),
  });
  return response;
};

const chronatum = new PoHClient({
  apiKey: process.env.CHRONATUM_API_KEY!,
  fetch: monitoredFetch,
});

• Probe authenticated GET /partner/usage?days=1 every five minutes.
• Alert on sustained 5xx responses, p95 latency above your threshold, repeated 429s, and low quota headroom.
• Include X-Request-Id and UTC time in support reports.