Payments

How it works

Some requests answer 402 Payment Required. When the agent hits one, it settles the charge and returns the body plus a receipt. The money comes from your wallet — one you link once, held by your passkey, never by the agent. Signing happens only on the trusted control plane; the sandbox that runs the turn holds no keys.

Four things are always true of a payment:

• It's yours. A spend only ever draws from the linked wallet of the person who asked. There is no shared or platform account an agent can quietly fall back to.
• You approve it. Every paid request pauses for a human approval before any money moves, and the card shows the amount and the destination.
• It's on the record. Each settlement writes a signed receipt with the onchain reference, so you can always see what was spent and verify it on the explorer.
• It expires. Linking grants a short-lived, capped permission to spend — not custody of your funds, which stay in your wallet the whole time. The permission lapses on its own; once it does, the agent can't pay until you re-approve with your passkey, so no standing authority ever builds up on the server.

Link a wallet

Ask to link a wallet and you get a one-time link. Open it on your device, approve with a passkey, and you're set — the agent can now pay from that wallet, within the limits the key carries. Only a non-secret reference to the key is stored against your persona; the key material never leaves your device, and the agent never sees it.

On a testnet deployment, a freshly linked wallet is funded automatically so it can cover the small onchain fee its first payment needs. Just ask:

you:    link a wallet
agent:  Here's a secure link to set up your spending wallet: …
        (open it, approve with your passkey, done)

Check and manage your wallet

The wallet tools answer in plain language and cost nothing to run — they read your own wallet, they never move money. Ask naturally; the agent reaches for the right one.

A payment tool is for buying something; these are for looking after the wallet itself. Asking "list my wallet" never spends money.

What keeps it safe

The wallet is non-custodial: your passkey authorizes a scoped, expiring key that can only make the kind of small settlement payment the agent needs, and you can revoke it at any time. Enforcement is layered, so no single check is load-bearing:

• Own-wallet-only. A caller's payment is always from their own linked wallet or it doesn't happen — the code has no path that pays from anyone else's account.
• Per-person isolation. In a shared conversation, each person sees and spends only their own wallet. Balances, history, and links never cross between people — the one exception is an admin roster, which is gated on a durable admin permission.
• Caps and budgets. The linked key carries onchain spend limits, and the control plane enforces per-request and per-conversation ceilings before it ever signs.
• Human approval. Spending is a change outside the conversation, so a paid request pauses for a human whenever the conversation has read outside content — the same capability gate that protects every sensitive action (see Trust), which is what stops a page from talking the agent into spending.

Configuration

Payments are off until a deployment configures them. The settlement network and wallet-link surface are the main knobs:

The wallet tools are built-in, so an agent scoped to an explicit tool set needs wallet_status, wallet_history, wallet_link, wallet_unlink, and wallet_roster in its allowlist to offer them.