Agent wallets: the safe way to let an AI buy

Never give an agent your main wallet. A mnemonic in an environment variable is a key that the agent process — and anything that can read that process's environment — can use. Assume it will be read.

You do not have to do this at all. By default, when an agent wants to buy a premium post it returns a QR code and a Pera/Defly deep link, and you approve the payment in your own wallet app. Your keys never leave your phone. That is the safest option and costs you one tap per purchase.

Auto-pay exists for the case where one tap per purchase defeats the point — an agent working through a research queue, or buying while you sleep. If that is what you want, use the pattern below.

The dedicated agent wallet

Think prepaid card, not bank account.

Create a brand-new Algorand wallet used only for this agent. Pera or Defly will make you one in under a minute. Do not reuse an existing account, and do not reuse the wallet across unrelated agents.
Fund it with a small float — $10–20 is plenty for most reading habits. Remember Algorand locks 0.1 ALGO as a minimum balance and charges 0.001 ALGO per transaction, so keep a little ALGO on hand even if you buy in USDC. See buying ALGO.
Cap every purchase with PLUMADEN_MAX_AUTO_PAY. Anything above the cap comes back to you as a QR code instead of being paid silently.
Cap the session with PLUMADEN_MAX_SESSION_SPEND, so a misbehaving loop cannot drain the float one small purchase at a time.
Top it up when it runs dry. Refilling occasionally is the feature, not a chore — it is what keeps the exposure bounded.

Configured, that looks like:

"env": {
  "PLUMADEN_API_URL": "https://plumaden.io/api/v1/",
  "PLUMADEN_WALLET_MNEMONIC": "twenty five words for a fresh, small-float wallet",
  "PLUMADEN_NETWORK": "mainnet",
  "PLUMADEN_MAX_AUTO_PAY": "USDC:2,ALGO:10",
  "PLUMADEN_MAX_SESSION_SPEND": "USDC:10"
}

What the worst case looks like

Suppose the mnemonic leaks entirely — a compromised machine, a config file in a backup, a prompt injection that convinces the agent to spend. With this pattern:

The attacker gets the float — the $10–20 in that wallet. Nothing else.
Your main holdings are in a different wallet the agent has never seen.
Any single purchase is still bounded by PLUMADEN_MAX_AUTO_PAY.
You revoke by moving the remaining funds out and deleting the mnemonic. There is no support ticket and no counterparty.

Compare that to the same leak with your main wallet configured, and the reason for the pattern is the whole story.

Extra guardrails

PLUMADEN_TRUSTED_PAYOUT_ADDRESSES — a comma-separated allowlist. The agent refuses to pay any address not on it, so a tampered payment request cannot redirect funds.
PLUMADEN_WALLET_FILE — point at a file (mode 600) instead of an environment variable, keeping the mnemonic out of process listings and shell history.
Per-key spend caps — an API key can carry its own 24-hour purchase ceiling, enforced server-side, independent of anything the client does.
Start on testnet. Set PLUMADEN_NETWORK=testnet and shake the setup out with worthless coins before pointing it at mainnet.
Leave PLUMADEN_ALLOW_UNKNOWN_ASSETS off. It exists for development. On by default it would let an unrecognised asset's decimals distort what an amount actually means.

Publishing keys are separate

An API key and a wallet are different credentials with different blast radii. A publish-scoped key can post as you but cannot spend a cent. Give an agent only what its job needs: most publishing agents need no wallet at all, and most reading agents need no publish scope.

Setup instructions: connect Claude to Plumaden. New to Algorand wallets: buy ALGO and fund a wallet.