WalletAgent payment control

All systems operational

OIDC-native Agent payments

Give Agents a budget.Keep the keys.

One wallet owned by the user. Explicit, revocable spending boundaries for every Agent. Standard x402 payments on Base.

Open Wallet Explore Sandbox

LIVE / BASE MAINNETwallet.realmroot.devUTC 14:32:08

OWNER WALLET

Available balance

2,480.00USDC

23%

MONTH SPEND: $182.40
AVAILABLE: $612.60

AGENT POLICIES03 ACTIVE

Research Agentapi.weather.dev · x402

DAILY LIMIT$100

Commerce Agent2 allowed merchants

DAILY LIMIT$250

Data AgentSandbox only

DAILY LIMIT$25

PAYMENT STREAMLIVE

14:32:08

$0.025api.weather.dev

SETTLED

14:31:52

$1.20maps.example

AUTHORIZED

14:30:17

$84.00unknown origin

BLOCKED

14:28:44

$0.008data.market.dev

SETTLED

No private keys exposedDPoP on every paymentPer-Agent budgets

Spending controls

Every Agent.Its own payment boundary.

Identity does not imply spending authority. Every restriction is checked again before every signature.

Exact budgets

Set total, per-payment, daily, and monthly USDC limits with an explicit expiration time.

USDC / TIME

Named destinations

Allow only approved merchant origins, recipient addresses, and payment assets.

ORIGIN / TO

Immediate control

Pause one Agent or freeze every Agent payment without rotating the user wallet.

PAUSE / FREEZE

x402 payment flow

The Agent pays.The Wallet holds the boundary.

One payment authorization. One complete evidence trail.

RESOURCE SERVERHTTP 402PAYMENT-REQUIRED

Request

The business API returns PAYMENT-REQUIRED.

Authorize

The Agent forwards the requirement with a stable idempotency key.

Sign

Wallet checks identity, DPoP, and policy before asking CDP to sign.

Settle

The Agent retries the request and Wallet verifies the USDC transfer.

SETTLEMENT200 OKPAYMENT-RESPONSE

Trust boundary

The Agent never receives a wallet key.

CDP holds signing authority. Wallet accepts short-lived, DPoP-bound Agent tokens and applies controller-defined policy before every signature.

Identity: Any compatible OIDC provider; Realmroot is optional
Signing: CDP delegated signing with no private-key export
Network: Base Mainnet; Base Sepolia in Sandbox
Recovery: Idempotent authorization, settlement checks, full audit

OIDC · DPoP · x402 · USDC

Let Agents pay without holding your wallet.

Start in Sandbox and give your first Agent a revocable USDC spending policy.

Explore Sandbox