Every link below is the exact page to sign up and the exact page where the key lives. Paste each key into agent-authority/.env (gitignored) under the variable name shown, then restart the API (npm run api). Anything already done is marked.
Done today
- Stripe (sandbox) — a dedicated Okay Seal sandbox (
acct_1UBRCk0skDhnCdR2) was created in your dashboard, Issuing was activated in it, itssk_test_key is in.env, an Issuing cardholder exists (STRIPE_ISSUING_CARDHOLDER), and the v2 financial account id is recorded (STRIPE_FINANCIAL_ACCOUNT). Mission Wallet holds work. Card minting is blocked on one thing only: the sandbox's financial account ispendinguntil the sandbox account is activated. Open https://dashboard.stripe.com/acct_1UBRCk0skDhnCdR2/test/dashboard and complete "Activate your account" with test details (Stripe accepts placeholder values in sandboxes); it includes accepting Stripe's services agreement, which only you should do. Once the financial account showsopen, runnpx tsx data/mint-test.mtsor just use the app; nothing else needs to change. Webhook secret:stripe listen --forward-to localhost:4641/v1/webhooks/stripe. - Steel (cloud browser) —
STEEL_API_KEYstored; a live session was created and released and the browser provider's live test passed. Credentials API live test passes (create, list, delete) after correcting the delete call to Steel's JSON-body form. - Agent-owned SMS number — now bring-your-own (BYO), per user. The operator no longer runs one global Vonage account. Each user connects their own Vonage or Twilio account in the app (Settings → Phone number), buys a number there (billed to them, ~$1/month), and the app sets the inbound webhook itself. Corey's existing
VONAGE_API_KEY/VONAGE_API_SECRETstill work as an optional operator-provided fallback (off unless the env is set; only shown to users who have no account of their own). The −$0.73 balance only matters for that fallback. - Crossmint (staging) — keys stored and validated; connector rewritten to the verified order-intent API. In your console the JWT setting was left on Crossmint Auth (built in; the other options need a public JWKS URL we don't have yet), so no console change was needed. The card-link page is built: open http://localhost:4640/connectors/crossmint, sign in with your email or Google, save your card in Crossmint's PCI iframe, verify it (email code + passkey), set the weekly or monthly limit, tap your passkey, and press Connect. That last step registers the permission with Okay Seal automatically. The React SDK (
@crossmint/client-sdk-react-ui) was installed in the web app. - Coinbase business signup — a description that includes products, services and revenue model (their check flagged yours as incomplete) is in the section below.
- Mercury (business cards) — fully proven live: token validated, your checking account and your agent card ("Corey Costa's Credit Card", $2/day, last4 7947) are connected in the app, and the live proof revealed the card through Mercury Vault inside the injector with the card left untouched. Facts learned from Mercury's API: reveal is a GET on vault-api.mercury.com, only agent cards can be revealed, agent-card limits and unfreeze cannot be changed by API (the human sets the limit in the dashboard; our policy engine enforces per-purchase amounts under it), and the token is IP-allowlisted so the API pins IPv4. Fund the checking account before a real purchase.
- Privacy.com (production) — key stored and validated; a $1 single-use card was minted by API and closed again as proof; the app now points at the production API. Connected in the app as a consumer card source.
- AgentMail — your inbox
agent-authority@agentmail.toalready existed in the console and the key is scoped to it: it can read and send messages there (verified read-only), but not manage inboxes, which is fine for our use. Wired asAGENTMAIL_INBOX;email.sendcan now go out through AgentMail (via: "agentmail") and the injector can pick up email OTPs sent to that address. Nothing has been sent yet; say the word for a test email to yourself. - Twilio (operator side) — your API key (SK…) is stored and validated; it belongs to
AC7665c77ea3023d350d49c8e5cd7530a4("My First Twilio Account", Trial). Twilio Connect looks retired from the console: the docs still describe it and the REST API still lists Connect Apps (we get an empty list, so the resource exists), but creating one is console-only and both console pages 404 —console.twilio.com/us1/account/connect-appsin the new One Console andtwilio.com/console/connect-appsin the legacy one — and a console search for "connect app" only returns the unrelated "Twilio Agent Connect" product. The OAuth Apps page (Settings → the OAuth section, with token expiry and per-product scopes) is a different feature: client credentials for calling your own Twilio account's APIs, not a way for another customer to authorize us. So Twilio Connect is parked; ask Twilio support whether Connect Apps are still provisioned for new accounts if we ever want the one-click path. Nothing is blocked: users paste their own Twilio or Vonage keys today. - OpenAI (built-in AI) —
OPENAI_API_KEYset, modelgpt-5.6-luna, verified live. The key was pasted into chat, so rotate it when convenient: https://platform.openai.com/api-keys
Keys to collect (self-serve, no approval)
| Provider | Sign up | Where the key is | .env variables |
Notes |
|---|---|---|---|---|
| Stripe (Mission Wallet holds, webhooks, Issuing sandbox) | done | Test keys live inside a Sandbox: https://dashboard.stripe.com/sandboxes → open the sandbox → Developers → API keys · Webhook signing secret: https://dashboard.stripe.com/test/webhooks (add endpoint http://localhost:4641/v1/webhooks/stripe for local, or use stripe listen) · Issuing sandbox: https://dashboard.stripe.com/test/issuing/overview |
STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_ISSUING_CARDHOLDER |
Use the test key. Issuing sandbox needs a cardholder created once in the dashboard. |
| Steel (cloud browser + Credentials API) | https://app.steel.dev/sign-up | Dashboard → Settings → API Keys: https://app.steel.dev/settings/api-keys | STEEL_API_KEY, STEEL_PLAN=launch |
Launch tier is $0 + usage, 15-minute sessions. Docs: https://docs.steel.dev/overview/credentials-api/overview |
| Privacy.com (consumer single-use cards) | done (Premium) | Account page → API section (paid plan required): https://app.privacy.com/account · Developer docs: https://developers.privacy.com/docs/getting-started | PRIVACY_API_KEY, PRIVACY_API_BASE=https://sandbox.privacy.com/v1 |
60 new cards/month is enough for a single user because recurring vendors reuse a merchant-locked card (one card per vendor, not per purchase). It is a consumer rail: it serves you and testing, not other customers; for them the Mission Wallet (Stripe Issuing) and Mercury rails scale. |
| Coinbase Developer Platform (embedded wallets, Spend Permissions, onramp) | https://portal.cdp.coinbase.com/ | API keys: https://portal.cdp.coinbase.com/projects/api-keys · Wallet Secret: https://portal.cdp.coinbase.com/products/server-wallets → "Wallet Secret" · Embedded wallets settings: https://portal.cdp.coinbase.com/products/embedded-wallets | CDP_API_KEY_ID, CDP_API_KEY_SECRET, CDP_WALLET_SECRET |
Download the API key JSON once; it is not shown again. |
| Base Sepolia test funds (Proof E) | no signup of its own: the CDP faucet is a page inside the Coinbase Developer Platform account you are creating; Circle's USDC faucet needs no account at all | ETH faucet: https://portal.cdp.coinbase.com/products/faucet · USDC faucet: https://faucet.circle.com/ (select Base Sepolia) | SPENDER_PRIVATE_KEY, TEST_ACCOUNT_PRIVATE_KEY, BASE_SEPOLIA_RPC_URL=https://sepolia.base.org |
Generate two fresh keys with npx tsx -e "import{generatePrivateKey}from'viem/accounts';console.log(generatePrivateKey())". Fund the spender with ETH and the test account with ≥40 USDC. |
| Crossmint (link an existing Visa/Mastercard) | https://staging.crossmint.com/console (staging) | Console → Integrate → API Keys (server-side key with agents scopes): https://staging.crossmint.com/console/projects/apiKeys · Quickstart: https://docs.crossmint.com/agents/cards-quickstart |
CROSSMINT_API_KEY, CROSSMINT_CARD_ID |
Run the quickstart's card-link iframe once with your own card to get the card id. |
| Mercury (business agent cards) | done | Settings → Tokens: https://app.mercury.com/settings/tokens (Read and Write, IP allowlist required) · Cards: https://app.mercury.com/cards → create an agent card · Docs: https://docs.mercury.com/docs/getting-started | MERCURY_API_TOKEN, MERCURY_ACCOUNT_ID, MERCURY_AGENT_CARD_ID |
Mercury requires a static egress IP for read/write tokens; local dev will need your current public IP allowlisted. |
| Phone number for agent MFA — bring your own (Vonage or Twilio) | The user signs up, not us: Vonage https://dashboard.nexmo.com/sign-up · Twilio https://www.twilio.com/try-twilio | Vonage: API key + secret at https://dashboard.nexmo.com/settings · Twilio: Account SID + Auth Token at https://console.twilio.com (Account Info) · Twilio Connect (one click, no pasting): the user presses "Connect Twilio" in the app and approves on Twilio's hosted page | none for users. Operator only: TWILIO_CONNECT_APP_SID + our TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN to offer Twilio Connect; VONAGE_API_KEY/VONAGE_API_SECRET/VONAGE_PHONE_NUMBER only if you want the optional operator fallback (off by default) |
How it works for the user: in the app open Settings → Phone number, pick Twilio Connect (one click) or paste Vonage key+secret / Twilio SID+token; the app verifies them, then search and buy a number there (a passkey step-up confirms the purchase; it is billed to their carrier account). Nothing to point manually: the app sets the number's inbound webhook to POST /v1/webhooks/<provider>/inbound (the API must be reachable from the internet — ngrok/Cloudflare tunnel in dev; Twilio deliveries are signature-checked). Twilio Connect = one click, billed to the user; needs us to create a Connect App once in our Twilio console (https://console.twilio.com → Account → Connect Apps: set the Authorize URL to https://<api>/v1/mfa/twilio/connect/callback, permission post-all) and put its SID in TWILIO_CONNECT_APP_SID. Why BYO: the operator is never the carrier customer; the user's own account carries the messaging, its billing and its compliance (A2P registration, KYC), so the operator is not responsible for anyone's phone or messaging usage. |
| Stripe Link CLI (personal-use POC only) | You already have a Link account | There is no API key on app.link.com/settings. Link uses a device login instead: in a terminal run npx @stripe/link-cli auth login, open the URL it prints, sign in to Link, type the short phrase it shows. The CLI then saves a token file; run npx @stripe/link-cli auth status to see it. Docs: https://docs.stripe.com/agentic-commerce/link-cli |
LINK_ACCESS_TOKEN (from npx @stripe/link-cli auth token) |
Personal use only under Link's AUP until Stripe issues us an OAuth client (see outreach). |
| Safe (business treasury) | https://app.safe.global/welcome | Create a Safe on Base; Apps → Spending Limits, or we generate the setAllowance transaction for you |
(Safe address + delegate key) | Docs: https://docs.safe.global/home/ai-agent-quickstarts/agent-with-spending-limit |
Google Cloud (gmail.send, Calendar) |
https://console.cloud.google.com/projectcreate | OAuth consent: https://console.cloud.google.com/apis/credentials/consent · Credentials: https://console.cloud.google.com/apis/credentials | GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET |
Keep the app in Testing until verification; 100 test users. |
| Anthropic (optional second model) | https://console.anthropic.com/ | https://console.anthropic.com/settings/keys | ANTHROPIC_API_KEY |
Not needed now that OpenAI is wired. |
| Lithic (issuing sandbox) | https://docs.lithic.com/docs/sign-up → https://sandbox.lithic.com/ | Sandbox dashboard → API keys | LITHIC_API_KEY |
Production requires the sales conversation below. |
How the card rails serve 1,000 users (the Privacy.com question)
Privacy.com is bring-your-own: it is not a pool we share. A user who already has a Privacy.com account connects their own API key in the app, and their own plan's 60 cards a month are theirs. Privacy.com has no OAuth "log in with Privacy" for third-party apps, so this rail is for you and for power users, not the mass market. The rails that scale to 1,000 users without each of them having an account anywhere are:
- Mission Wallet (Stripe Issuing, sandbox live now): we mint the card from our own program; no per-user limit beyond Stripe's program limits once production is approved.
- Crossmint agent cards: a consumer links the Visa or Mastercard they already have, once, in our app; every purchase gets a one-time number. No Privacy.com involved.
- Handoff Checkout: the human pays on their phone. Works for everyone, always.
- USDC on Base via Coinbase embedded wallets, for anything that accepts crypto or x402.
Coinbase business description (paste this)
Okay Seal is a software platform that lets people and businesses delegate bounded spending authority to AI agents. Products: (1) a policy engine that turns a plain-English mission into enforceable spending limits, merchant rules and approval thresholds; (2) user-owned embedded wallets created with the Coinbase Developer Platform, with on-chain spend permissions so an agent can pay for APIs, services and merchants in USDC only within a limit the user signed; (3) card and cloud-browser rails for merchants that do not accept crypto. Revenue model: monthly subscriptions ($20 to $100 per month tiers) plus metered usage credits and an optional 1% software fee on agent-completed purchases, billed separately through Stripe. We never take custody of user funds: users hold their own keys and can revoke an agent's permission on-chain at any time.
Outreach: status as of 2026-09-03
Reply address for everything below is agent-authority@agentmail.to unless noted. Several of these forms reject Gmail addresses outright, which is why the AgentMail inbox is the contact of record. Poll it with the AgentMail API; do not wait on fljuiceman@gmail.com.
| Channel | Status | Reference |
|---|---|---|
| Stripe, email to danhill@stripe.com (Link agent OAuth client) | Delivered, awaiting reply | sent from fljuiceman@gmail.com |
| Stripe Issuing, sales form | Submitted | a 15-minute call slot was offered and deliberately not booked |
| Stripe Agentic Commerce Suite waitlist | Submitted | use case: AI platform embedding commerce |
| PayPal Agentic Commerce Services | Submitted | paypal.ai form; its mandatory marketing-consent box had to be ticked |
| Lithic issuing program | Submitted | confirmation 6f96c82c-091a-4d57-98f5-52088d97f564 |
| Twilio Connect vs OAuth Apps | Ticket #29351456 open | help.twilio.com, Developer plan, ~1 business day |
| Visa Intelligent Commerce | Blocked, needs Corey | requires creating a Visa Developer account with a password at developer.visa.com |
Dead addresses, do not reuse: help@twilio.com was deprecated on 2023-05-15 and no longer creates tickets; sales@lithic.com does not exist (550 5.1.1). The working routes are the Twilio Help Center and https://www.lithic.com/about/contact.
Details submitted, kept consistent across forms: Corey Costa, MDML Technologies LLC (Florida LLC), website rawjuicecafe.com with a note that the product site is not public, phone +1 386 338 3479, LinkedIn https://www.linkedin.com/in/corey-costa-24b6b4192, US only, ~1,000 users at launch, average ticket under $200, funding under $5M, card volume under $1M.