Management SDK

@stableops/agent-payments-api-sdk is the dedicated Agent Payments management client. Run it only in a trusted operator service, never in an Agent runtime or browser bundle.

Install

pnpm add @stableops/agent-payments-api-sdk

Create a management client

The management API key scopes the organization, environment, and product:

import { StableOpsAgentPayments } from '@stableops/agent-payments-api-sdk'

const apiKey = process.env.STABLEOPS_API_KEY?.trim()
if (!apiKey) throw new Error('Missing STABLEOPS_API_KEY')

const management = new StableOpsAgentPayments({
  apiKey,
  baseUrl: process.env.STABLEOPS_API_URL,
})

Available resources

Amount fields use two different units and must not be mixed:

• Spending-policy and budget fields such as automaticPaymentThresholdAtomic, perPaymentLimitAtomic, agentDailyLimitAtomic, and limitAtomic always use the six-decimal USDC budget unit, so 1000000 always means 1 USDC.
• Payment, approval, and receipt fields such as maxAmountAtomic use the network token's onchain atomic unit and must be interpreted with assetDecimals. BNB Smart Chain and its testnet use 18 decimals; all other currently supported networks use 6.

For example, a 1 USDC payment on BNB Smart Chain has an x402 quote and maxAmountAtomic of 1000000000000000000, while its policy per-payment limit and daily budget are still 1000000. The server rounds budget conversion upward so a very small 18-decimal token amount cannot bypass budget accounting.

Policy versions are immutable; create and explicitly activate a new version to change rules. See the supported scope in the introduction for the complete decimals table.

Agent Keys are shown once

const credential = await management.agents.createKey('agent_...', {
  name: 'production-runtime',
})

if (!credential.secret) throw new Error('The one-time Agent Key was not returned')
console.log(`STABLEOPS_AGENT_KEY=${credential.secret}`) // Print only during secure initial setup.

The API cannot return the plaintext again. Revoke and replace a lost or exposed key.

Use a separate administrator session for decisions

Management API keys may read the approval queue. Approval and rejection are high-risk operations and require a short-lived access token from the current signed-in StableOps organization-administrator session. Most integrations should use the console approvals page; the mode below is only for console code that already has a StableOps sign-in session:

async function approveFromDashboardSession(accessToken: string) {
  const dashboard = new StableOpsAgentPayments({
    accessToken,
    environment: 'sandbox',
    baseUrl: process.env.STABLEOPS_API_URL,
  })
  const approvals = await dashboard.approvals.list()
  const approval = approvals[0]
  if (!approval) throw new Error('There are no pending approvals')
  await dashboard.approvals.approve(approval.id, 'Routine data purchase within budget')
}

Do not configure apiKey and accessToken on the same client. Do not cache the administrator token, store it in an environment variable, or give it to the Agent runtime.

See the quickstart for the complete wallet, policy, and payment flow.