How credit metering works

Metered features are hard to bill correctly: you don't know the exact cost until after the work is done, but you can't let a request run if the customer can't pay for it. SATTVA solves this with a pre-authorize-then-settle flow.

Pre-authorize

Before calling a provider, we estimate the worst-case cost and place a hold on that many credits. If the balance can't cover the hold, the request is rejected with a 402 before any money is spent — so a customer is never charged for work that couldn't start.

Settle

After the call, we compute the real cost from the tokens used and settle against the hold — refunding the unused remainder. Because the hold always over-estimates, settlement only ever refunds; it never charges more. On failure, the entire hold is refunded and the error is recorded.

Why a ledger

• Every movement is an append-only, idempotent entry — safe to retry exactly once.
• Balances are row-locked, so concurrent debits can never oversell.
• A nightly reconcile heals any drift between the balance and the ledger sum.