[{"data":1,"prerenderedAt":728},["ShallowReactive",2],{"content-\u002Fresources\u002Fmore\u002Fstablecoin-payouts-for-ai-agents":3,"resources-category-stablecoin-payouts-for-ai-agents":713},{"title":4,"seoTitle":5,"description":6,"date":7,"updated":7,"category":8,"faq":9,"howto":28,"body":29},"Stablecoin payouts for AI agents: safe design with an MCP server, CLI and Agent Skills (2026)","Stablecoin payments for AI agents: safe payout design","How to let an AI agent quote and send stablecoin payouts safely: approval thresholds, spend limits, audit trails, a surface map and a policy template.","2026-11-08","payments",[10,13,16,19,22,25],{"q":11,"a":12},"What is an MCP server for payments?","It is a hosted endpoint that gives an AI agent a payments API as callable tools, using the Model Context Protocol. BlindPay's MCP server lets an agent quote payouts, create customers, send payouts and track them in plain English, after you sign in over OAuth and pick one instance. The tools are generated from the public API, so the same rules apply.",{"q":14,"a":15},"Can an agent send money unattended?","Technically yes, but BlindPay's docs advise against it by default. The MCP server does not block a call on its own, so a confirmation step is your job. Keep a human approval for money movement, start on a development instance, or connect to the read-only endpoint until the policy is proven. Unattended runs suit only small, pre-approved recipients.",{"q":17,"a":18},"How do I limit spend?","Enforce limits in your own code, outside the model. BlindPay's API keys carry full read and write access and there is no restricted key type yet, so a per-payment cap, a daily total and a recipient allowlist belong in the layer that calls the API. The agent proposes, your policy checks, and a person approves above the threshold.",{"q":20,"a":21},"How are agent payouts audited?","Every MCP tool call goes through the same API as a direct request, with the same KYC and KYB requirements, limits and audit trail, per BlindPay's docs. Add your own record of the quote ID, payout ID, approver, Idempotency-Key and webhook events for each payment, so one reviewer can reconstruct who approved what and when.",{"q":23,"a":24},"Can an agent explore without changing anything?","Yes. The read-only MCP endpoint serves only the read tools: 42 of the 93 tools in BlindPay's tools reference. An agent there can look up customers, bank accounts, payouts and rails, but it cannot create a quote, add a bank account or send a payout. It is a good first connection for testing prompts.",{"q":26,"a":27},"Do I need MCP, or can the agent use the CLI or REST API?","Any of the three works. MCP gives the agent tools with OAuth sign-in. The CLI gives scripts and agents JSON output, a schema command and predictable exit codes. The REST API suits app builders without an MCP host. Agent Skills add BlindPay knowledge on top. Pick the surface your agent host supports.",null,{"type":30,"value":31,"toc":704},"minimark",[32,36,50,56,80,85,88,128,150,154,157,347,381,385,388,446,449,453,456,575,578,582,628,631,635,681,685,700],[33,34,35],"p",{},"AI agents can create quotes, execute payouts and track status through a payments API, and BlindPay exposes its REST API, an MCP server, Agent Skills and a CLI with structured JSON output for exactly that. BlindPay describes itself as the most AI-native stablecoin infrastructure. The safe design keeps a person and a policy in the loop.",[33,37,38,39,44,45,49],{},"This guide is for developers building agentic finance workflows, as of November 2026. A stablecoin is a digital dollar token such as USDC; the recipient still receives local currency in a bank account. The pillar guide is ",[40,41,43],"a",{"href":42},"\u002Fresources\u002Fmore\u002Fwhat-is-a-stablecoin-payouts-api","what a stablecoin payouts API is",", and the payout steps are in ",[40,46,48],{"href":47},"\u002Fresources\u002Fmore\u002Fhow-stablecoin-payouts-work-step-by-step","how a stablecoin payout works",".",[33,51,52],{},[53,54,55],"strong",{},"Key takeaways",[57,58,59,63,66,69,72],"ul",{},[60,61,62],"li",{},"BlindPay's hosted MCP server exposes 93 tools generated from the public API, and the read-only endpoint serves the 42 read tools.",[60,64,65],{},"The MCP server does not block a call on its own: keep a confirmation step, start on a development instance, or connect read-only.",[60,67,68],{},"BlindPay API keys have full read and write access to an instance, so spend limits and allowlists must live in your own code.",[60,70,71],{},"A payout quote locks rate and fees for 5 minutes, and a quote can back only one payout, so approvals should bind to a quote ID.",[60,73,74,75,79],{},"Confirm outcomes by signed webhook (",[76,77,78],"code",{},"payout.complete","), not by the agent's own report.",[81,82,84],"h2",{"id":83},"how-should-an-agent-move-through-a-payout","How should an agent move through a payout?",[33,86,87],{},"In the same five steps as a person: recipient, quote, approval, execute, confirm.",[89,90,91,97,107,113,119],"ol",{},[60,92,93,96],{},[53,94,95],{},"Create the recipient."," Add the bank account to a customer that has passed KYC or KYB.",[60,98,99,102,103,106],{},[53,100,101],{},"Quote."," Create a payout quote. It locks rate and fees for 5 minutes. Read ",[76,104,105],{},"expires_at"," (epoch milliseconds).",[60,108,109,112],{},[53,110,111],{},"Approve."," A policy check, and a human above the threshold, approves that exact quote.",[60,114,115,118],{},[53,116,117],{},"Execute."," Create the payout from the quote with an Idempotency-Key.",[60,120,121,124,125,127],{},[53,122,123],{},"Confirm and reconcile."," Wait for ",[76,126,78],{}," and match it to the invoice.",[33,129,130,131,135,136,140,141,145,146,49],{},"The live-rate side is in ",[40,132,134],{"href":133},"\u002Fresources\u002Fmore\u002Fai-agents-live-fx-quotes-mcp","AI agents and live FX quotes over MCP",", and a full product build is in ",[40,137,139],{"href":138},"\u002Fresources\u002Fmore\u002Fbuild-a-neobank-with-ai-agents","build a neobank with AI agents",". For protocols that let agents pay each other, see ",[40,142,144],{"href":143},"\u002Fresources\u002Fmore\u002Fagent-payment-protocols-compared","agent payment protocols compared",". BlindPay's overview is on ",[40,147,149],{"href":148},"\u002Fagentic-payments","agentic payments",[81,151,153],{"id":152},"which-blindpay-surface-serves-which-agent-task","Which BlindPay surface serves which agent task?",[33,155,156],{},"MCP for tool use, the CLI for scripts, the REST API for apps, Agent Skills for knowledge. Only confirmed capabilities are listed.",[158,159,160,189],"table",{},[161,162,163],"thead",{},[164,165,166,170,177,183,186],"tr",{},[167,168,169],"th",{},"Agent task",[167,171,172,173,176],{},"MCP server (",[76,174,175],{},"\u002Fmcp",")",[167,178,179,180,176],{},"Read-only MCP (",[76,181,182],{},"\u002Fmcp\u002Freadonly",[167,184,185],{},"CLI",[167,187,188],{},"REST API",[190,191,192,219,243,268,293,325],"tbody",{},[164,193,194,198,204,211,216],{},[195,196,197],"td",{},"Create a recipient",[195,199,200,203],{},[76,201,202],{},"PostV1InstancesCustomersBankAccounts"," (write)",[195,205,206,207,210],{},"Not served; ",[76,208,209],{},"GetV1InstancesCustomersBankAccounts"," reads",[195,212,213],{},[76,214,215],{},"blindpay bank_accounts create --customer-id re_...",[195,217,218],{},"Yes",[164,220,221,224,233,236,241],{},[195,222,223],{},"Quote",[195,225,226,229,230],{},[76,227,228],{},"PostV1InstancesQuotes",", ",[76,231,232],{},"PostV1InstancesQuotesFx",[195,234,235],{},"Not served",[195,237,238],{},[76,239,240],{},"blindpay quotes create",[195,242,218],{},[164,244,245,248,259,261,266],{},[195,246,247],{},"Execute",[195,249,250,229,253,229,256],{},[76,251,252],{},"PostV1InstancesPayoutsEvm",[76,254,255],{},"PostV1InstancesPayoutsSolana",[76,257,258],{},"PostV1InstancesPayoutsStellar",[195,260,235],{},[195,262,263],{},[76,264,265],{},"blindpay payouts create --quote-id qu_...",[195,267,218],{},[164,269,270,273,281,284,291],{},[195,271,272],{},"Check status",[195,274,275,229,278],{},[76,276,277],{},"GetV1InstancesPayoutsById",[76,279,280],{},"GetV1InstancesPayouts",[195,282,283],{},"Served",[195,285,286,287,290],{},"Commands support ",[76,288,289],{},"--json"," for parseable output",[195,292,218],{},[164,294,295,298,306,309,314],{},[195,296,297],{},"Reconcile",[195,299,300,229,302,305],{},[76,301,280],{},[76,303,304],{},"GetV1InstancesWebhookEndpoints",", webhook event resources",[195,307,308],{},"Reads served",[195,310,311,313],{},[76,312,289],{}," output into your ledger",[195,315,316,317,229,320,229,323],{},"Webhooks ",[76,318,319],{},"payout.new",[76,321,322],{},"payout.update",[76,324,78],{},[164,326,327,330,333,336,344],{},[195,328,329],{},"Learn BlindPay's rails and fields",[195,331,332],{},"Server instructions at connect time",[195,334,335],{},"Same",[195,337,338,229,341],{},[76,339,340],{},"blindpay schema",[76,342,343],{},"blindpay available rails",[195,345,346],{},"Docs",[33,348,349,350,353,354,357,358,229,362,366,367,371,372,376,377,49],{},"Agent Skills (",[76,351,352],{},"npx skills add blindpaylabs\u002Fskills",") teach the agent BlindPay's rails, corridors, fees and API patterns, but they do not execute anything. The local server (",[76,355,356],{},"npx -y @blindpay\u002Fmcp",") offers the same tools with an API key. Sources: the ",[40,359,361],{"href":360},"\u002Fdocs\u002Fbuild-with-ai","Build with AI",[40,363,365],{"href":364},"\u002Fdocs\u002Fmcp","MCP server"," and ",[40,368,370],{"href":369},"\u002Fdocs\u002Fmcp\u002Ftools","MCP tools"," docs, and the ",[40,373,375],{"href":374},"\u002Fblog\u002Fcli","CLI post",". Note that creating a quote is a write tool, so a read-only agent can look but cannot price. The wider story is in the ",[40,378,380],{"href":379},"\u002Fblog\u002Fmcp","MCP post",[81,382,384],{"id":383},"what-does-a-safe-agent-payout-design-include","What does a safe agent payout design include?",[33,386,387],{},"Six controls, each enforced outside the model.",[57,389,390,403,409,418,424,430],{},[60,391,392,395,396,402],{},[53,393,394],{},"Human approval thresholds."," Below a small amount and for an allowlisted recipient, the policy can auto-approve. Above it, a person approves. ",[40,397,401],{"href":398,"rel":399},"https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm062025-excessive-agency\u002F",[400],"nofollow","OWASP's guidance on excessive agency"," recommends requiring human approval for high-impact actions and enforcing authorization downstream, not by trusting the model.",[60,404,405,408],{},[53,406,407],{},"Spend limits."," BlindPay's docs say the dashboard creates one API key type with full read and write access, and a restricted key is not yet available. Put per-payment, daily and monthly caps in the code that calls the API.",[60,410,411,414,415,417],{},[53,412,413],{},"Quote expiry handling."," The approver sees the quote's amount, fees and recipient, and approves within the 5-minute window. If ",[76,416,105],{}," has passed, re-quote and approve again. A quote ID backs one payout only.",[60,419,420,423],{},[53,421,422],{},"Audit trail."," Log the prompt, the proposed action, the quote ID, the approver, the payout ID and the webhook event. BlindPay's MCP docs say tool calls share the same KYC and KYB requirements, limits and audit trail as direct API requests.",[60,425,426,429],{},[53,427,428],{},"KYC-verified recipients."," Only let the agent pay bank accounts you have already added and reviewed. Every payment flows through a customer that completed KYC or KYB, and the API user collects the data and BlindPay verifies it.",[60,431,432,435,436,229,439,366,442,445],{},[53,433,434],{},"Webhook-based confirmation."," Treat the payout as done only after a signed webhook. Verify the ",[76,437,438],{},"svix-id",[76,440,441],{},"svix-timestamp",[76,443,444],{},"svix-signature"," headers.",[33,447,448],{},"Build the approval screen from the structured quote data in your own code, not from text the model wrote, so the model cannot describe a different amount than the one it will send. This is our design advice, informed by OWASP's note that approvals fail when the dialog itself is manipulated.",[81,450,452],{"id":451},"what-is-a-safe-by-default-agent-payout-policy","What is a safe-by-default agent payout policy?",[33,454,455],{},"A policy file your own code loads and enforces before any money-moving call. This template is illustrative: the keys and numbers are placeholders you set, and none of it is a BlindPay feature or BlindPay's limits.",[457,458,463],"pre",{"className":459,"code":460,"language":461,"meta":462,"style":462},"language-yaml shiki shiki-themes github-light","agent_payout_policy:\n  environment: development        # switch to production only after review\n  connection: mcp_readonly        # read-only until the checks below pass\n  allowed_recipients: [ba_REPLACE_ME]   # bank accounts already reviewed\n  per_payment_cap_usd: 500        # placeholder\n  daily_cap_usd: 2000             # placeholder\n  auto_approve_below_usd: 0       # start at zero: everything needs a person\n  require_human_above_usd: 0\n  approval:\n    bind_to: quote_id             # approval is valid for one quote only\n    max_age_seconds: 240          # leave margin under the 5-minute quote life\n    show: [recipient, receiver_amount, fees, expires_at]\n  execute:\n    idempotency_key: per_payment  # reuse the key on retry\n  confirm:\n    source: webhook               # payout.complete, signature verified\n    on_failed_or_stuck: alert_human\n  log: [prompt, proposed_action, quote_id, approver, payout_id, webhook_event]\n","yaml","",[76,464,465,473,479,485,491,497,503,509,515,521,527,533,539,545,551,557,563,569],{"__ignoreMap":462},[466,467,470],"span",{"class":468,"line":469},"line",1,[466,471,472],{},"agent_payout_policy:\n",[466,474,476],{"class":468,"line":475},2,[466,477,478],{},"  environment: development        # switch to production only after review\n",[466,480,482],{"class":468,"line":481},3,[466,483,484],{},"  connection: mcp_readonly        # read-only until the checks below pass\n",[466,486,488],{"class":468,"line":487},4,[466,489,490],{},"  allowed_recipients: [ba_REPLACE_ME]   # bank accounts already reviewed\n",[466,492,494],{"class":468,"line":493},5,[466,495,496],{},"  per_payment_cap_usd: 500        # placeholder\n",[466,498,500],{"class":468,"line":499},6,[466,501,502],{},"  daily_cap_usd: 2000             # placeholder\n",[466,504,506],{"class":468,"line":505},7,[466,507,508],{},"  auto_approve_below_usd: 0       # start at zero: everything needs a person\n",[466,510,512],{"class":468,"line":511},8,[466,513,514],{},"  require_human_above_usd: 0\n",[466,516,518],{"class":468,"line":517},9,[466,519,520],{},"  approval:\n",[466,522,524],{"class":468,"line":523},10,[466,525,526],{},"    bind_to: quote_id             # approval is valid for one quote only\n",[466,528,530],{"class":468,"line":529},11,[466,531,532],{},"    max_age_seconds: 240          # leave margin under the 5-minute quote life\n",[466,534,536],{"class":468,"line":535},12,[466,537,538],{},"    show: [recipient, receiver_amount, fees, expires_at]\n",[466,540,542],{"class":468,"line":541},13,[466,543,544],{},"  execute:\n",[466,546,548],{"class":468,"line":547},14,[466,549,550],{},"    idempotency_key: per_payment  # reuse the key on retry\n",[466,552,554],{"class":468,"line":553},15,[466,555,556],{},"  confirm:\n",[466,558,560],{"class":468,"line":559},16,[466,561,562],{},"    source: webhook               # payout.complete, signature verified\n",[466,564,566],{"class":468,"line":565},17,[466,567,568],{},"    on_failed_or_stuck: alert_human\n",[466,570,572],{"class":468,"line":571},18,[466,573,574],{},"  log: [prompt, proposed_action, quote_id, approver, payout_id, webhook_event]\n",[33,576,577],{},"Start with approval for everything, watch a month of logs, then raise the auto-approve line for small payments to allowlisted recipients. Keep the model out of the policy: it proposes, your code decides.",[81,579,581],{"id":580},"what-should-the-safety-checklist-cover","What should the safety checklist cover?",[89,583,584,598,604,607,610,613,616,619,625],{},[60,585,586,587,590,591,594,595,49],{},"Run the agent on a development instance first. Payouts complete automatically, and ",[76,588,589],{},"request_amount"," 66600 forces ",[76,592,593],{},"failed"," and 77700 forces ",[76,596,597],{},"refunded",[60,599,600,601,603],{},"Connect read-only (",[76,602,182],{},") while you test prompts.",[60,605,606],{},"Keep the API key out of the model's context and out of client code.",[60,608,609],{},"Confirm the agent is signed in to one instance. The server fills the instance into every call.",[60,611,612],{},"Add the confirmation step yourself, since the server does not block calls on its own.",[60,614,615],{},"Check that every recipient has a verified customer behind it.",[60,617,618],{},"Send an Idempotency-Key on every execute call.",[60,620,621,622,624],{},"Verify webhook signatures and alert on ",[76,623,593],{}," or stuck payouts.",[60,626,627],{},"Know the disconnect path: in the dashboard, Settings, then Connected apps.",[33,629,630],{},"On custody: BlindPay operates as a non-custodial payment processor for payout flows from customer-controlled wallets: you authorize the exact amount and BlindPay executes that single transaction. If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet, or to the sending wallet when none is set; on Pix and other non-USD local rails the refund is automatic, while USD payouts and payouts whose review times out are refunded after an operator review. Optional BlindPay-managed wallets (beta) are custodial when you choose that path.",[81,632,634],{"id":633},"methodology-and-sources","Methodology and sources",[33,636,637,638,642,643,648,649,654,655,229,657,229,659,229,661,229,665,229,669,366,673,371,677,680],{},"External sources: ",[40,639,641],{"href":398,"rel":640},[400],"OWASP LLM06:2025 Excessive Agency",", the ",[40,644,647],{"href":645,"rel":646},"https:\u002F\u002Fmodelcontextprotocol.io\u002Fspecification\u002F2025-06-18\u002Fserver\u002Ftools",[400],"Model Context Protocol specification on tools",", and ",[40,650,653],{"href":651,"rel":652},"https:\u002F\u002Fmodelcontextprotocol.io",[400],"modelcontextprotocol.io",". BlindPay facts come from the ",[40,656,361],{"href":360},[40,658,365],{"href":364},[40,660,370],{"href":369},[40,662,664],{"href":663},"\u002Fdocs\u002Fpayouts","payouts",[40,666,668],{"href":667},"\u002Fdocs\u002Flearn\u002Fidempotency","idempotency",[40,670,672],{"href":671},"\u002Fdocs\u002Flearn\u002Fapi-keys","API keys",[40,674,676],{"href":675},"\u002Fdocs\u002Flearn\u002Fwebhooks","webhooks",[40,678,679],{"href":374},"BlindPay CLI post",". The attribution of the \"most AI-native stablecoin infrastructure\" claim is BlindPay's own description in that post. BlindPay publishes this article.",[81,682,684],{"id":683},"what-to-do-next","What to do next",[33,686,687,688,691,692,694,695,699],{},"Explore the ",[40,689,690],{"href":364},"BlindPay MCP server"," and the ",[40,693,185],{"href":374},". Connect an agent to the read-only endpoint on a development instance, run a payout to completed with the ",[40,696,698],{"href":697},"\u002Fdocs\u002Fquickstart-payout","payout quickstart",", and only then add approvals and a policy like the one above.",[701,702,703],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":462,"searchDepth":475,"depth":475,"links":705},[706,707,708,709,710,711,712],{"id":83,"depth":475,"text":84},{"id":152,"depth":475,"text":153},{"id":383,"depth":475,"text":384},{"id":451,"depth":475,"text":452},{"id":580,"depth":475,"text":581},{"id":633,"depth":475,"text":634},{"id":683,"depth":475,"text":684},[714,719,724],{"path":715,"title":716,"description":717,"date":718},"\u002Fresources\u002Fmore\u002Fstablecoin-payout-fx-policy-template","FX policy template for stablecoin payouts: tolerances, approvals, and float limits","A copyable FX policy for stablecoin payout teams: who can execute, re-quote tolerances, approval thresholds, float and depeg limits, and review cadence.","2026-10-17",{"path":720,"title":721,"description":722,"date":723},"\u002Fresources\u002Fmore\u002Fstablecoin-payout-approval-controls","Approval controls for stablecoin payouts: maker-checker, limits, and audit trails","How finance teams control stablecoin payouts: maker-checker approval that survives 5-minute quotes, payee checks, limits, idempotency, and an audit trail.","2026-10-06",{"path":725,"title":726,"description":727,"date":7},"\u002Fresources\u002Fmore\u002Fstablecoin-payins-vs-cards-vs-swift-wires","Stablecoin payins vs cards vs SWIFT wires: cost, speed and risk for cross-border B2B payments","Stablecoin vs SWIFT wire vs credit card for receiving cross-border B2B payments: how cost, speed, chargebacks, FX, and compliance compare.",1794399384304]