Give your AI agent a budget, not your wallet
Set a per-purchase cap, a daily cap and an expiry once. Your agent spends USDC only inside them, and you can stop it at any time.
Set a budget
The problem.
An agent with a funded hot wallet or a stored API key is a blank check for the funds that credential permits. A leaked key puts those funds at risk.
Limits that live in the agent's own software are only as strong as that software.
Spend alerts report activity after it happens; they do not impose a spending cap.
How it works.
- Sign inwith the wallet you already use, or with email, Google or Apple. Signing in is a message signature and moves nothing.
- Set your limits:daily, per purchase, and how many days they last.
- Approve once.One approval from your wallet. From then on the agent buys inside the limits.
- Revoke any timewith one more signature, in SingIt or without us on revoke.cash.
Base vs Solana
| Aspect | Base | Solana |
|---|---|---|
| What you approve | A USDC allowance to your own limiter contract, deployed for you (SingIt pays its gas) | The agent as delegate on your USDC account, for a total you choose |
| Who enforces the limits | The contract, on chain: daily limit, per-purchase limit and expiry are fixed in it | SingIt's server (on-chain: only the total SPL delegate amount) |
| Where the money is | In your wallet; for micro-payments your agent keeps a small float (up to 0.20 USDC by default) | In your wallet |
The one function that moves money
On Base, the limiter is a small contract with no admin, no proxy and no setter. It holds no tokens: each spend goes from your wallet to the payee in one transferFrom. For purchases through SingIt, that payee is your own agent, which pays the seller.
function spend(address payee, uint256 amount, bytes32 ref) external {
if (msg.sender != agent) revert NotAgent();
if (paused) revert IsPaused();
if (block.timestamp >= expiry) revert Expired();
if (amount > perPurchaseCap) revert PerPurchaseCapExceeded();
// ...
uint256 today = block.timestamp / 1 days;
uint256 spent = today == day ? spentToday : 0;
if (spent + amount > dailyCap) revert DailyCapExceeded();
// ...
if (!token.transferFrom(owner, payee, amount)) revert TransferFailed();
}From agent-allowance/src/AgentAllowance.sol (MIT).
A watcher that reads the chain
A watcher reads the chain, not SingIt's own records. On Base, a spend to anyone but your own agent, or an unusual burst of spends, pauses the limiter and alerts you. The guardian key can pause and nothing else: it can't move funds or raise limits.
What the budget pays for.
Gift cards, eSIMs and mobile top-ups through Bitrefill (details).
Live answers (weather, exchange rates, flight status, places), each one small paid x402 request to a checked seller at a capped price.
A chat that bills by the answer, and Venice for private chat, paid from the same limits.
What an agent budget contains
A SingIt agent budget has several separate boundaries. A per-purchase cap limits one purchase. A daily cap limits the sum for a UTC calendar day. An expiry ends spending after the chosen lifetime. The USDC approval is a separate total allowance. Choose each boundary for the purchases you want SingIt's own agent to make in the SingIt app.
These values answer different questions. A small per-purchase cap can reject one large purchase even when today's budget remains. A daily cap can reject another purchase after several smaller ones. An expiry rejects spending when the grant is no longer current. On Base, the daily limit follows the UTC calendar. The daily limit resets at 00:00 UTC. It is not a rolling 24-hour window: purchases on either side of midnight count against different days.
Base: the limiter contract
The owner approves USDC once from their own wallet to a limiter contract deployed for them. SingIt pays the deployment gas. The limiter holds no tokens. Each spend calls transferFrom to move USDC from the owner's wallet to the payee. The contract rejects a caller other than its configured agent. It also rejects a spend over the per-purchase cap, over the daily cap, after expiry or while paused.
The limits cannot change after deployment. There is no admin, proxy or setter that raises them. New limits require a new limiter and a new approval. The owner can pause from the app or wallet. Pause is a permanent emergency stop. To change limits, revoke and set up a new allowance. A paused Base limiter stays paused; resuming requires a new limiter. The guardian is a watcher that can pause and nothing else. It cannot move funds or change the caps.
To revoke, approve zero from the wallet. You can also use revoke.cash without SingIt. A pause and a revoked approval are different operations. The pause stops this limiter; revocation removes its token allowance. The app shows purchases and receipts so the owner can review spending.
Solana: delegate approval and server checks
On Solana, the owner's wallet approves the agent as SPL delegate on their USDC account for a total. The chain enforces that total, and one Revoke ends it. The daily limit, the per-purchase limit and the expiry are enforced by SingIt's server, not on-chain.
The Solana stop button records a pause so SingIt refuses new purchases. It does not remove the on-chain delegate approval; Revoke does. Only a new approval signed by the owner's wallet lifts the pause. A purchase reserved before the pause may still settle.
What these limits cover
AgentAllowance applies to purchases through SingIt's own agent in the SingIt app. A wallet signing x402 payments by itself is not limited by AgentAllowance. Client-side caps live in the client process and are only as strong as that process. Read the x402 budget guide before treating a per-call quote as a continuing daily allowance.
FAQ
Can SingIt or the agent take more than my Base limits?
- No. The caps and expiry are fixed in the Base limiter and hold even if SingIt's server or the agent is compromised.
How do I stop everything on Base?
- Revoke the USDC approval from your wallet, including through revoke.cash without SingIt. Pausing permanently stops the Base limiter; new spending requires a new limiter and approval.
Does setting up cost gas?
- On Base, SingIt deploys your limiter and pays its gas. The approval is a normal USDC approve from your wallet.
When does the Base daily cap reset?
- At 00:00 UTC. The contract counts calendar days, not a rolling 24 hours.
Can I raise an existing Base limit?
- No. New limits require a new limiter and a new approval.
Does a Solana pause revoke the delegate?
- No. It stops new purchases through SingIt. Revoke removes the on-chain approval.