# Agent payment workflow (external agent + CAI wallet)

> Level-3 reference for [skill.md](../skill.md). Fetch: `https://cai.com/skill-references/agent-payment-workflow.md`

## Agent payment workflow (external agent + CAI wallet)

**Division of labor:** The **user's agent** (OpenClaw, Cursor, etc.) discovers **how a third party wants to be paid** (official docs, invoice email, on-chain address, card checkout URL). **CAI** provides the **custodial wallet and payment APIs** — not platform代充 or reseller billing. CAI does **not** auto-discover OpenRouter (or other SaaS) billing rails; the agent owner instructs payment after the agent surfaces payee details.

**Typical flow:**

1. User: e.g. "Renew OpenRouter" / "Pay this invoice" / "Send USDT to this address."
2. **Agent:** Read third-party requirements (amount, chain, token, address, or card URL).
3. **Agent → CAI:** `wallet_balances` (and `get_exchange_rate` if needed). If short: `create_deposit_link` or `token_bridge_quote` + `token_bridge_execute` when appropriate — **partial_live**; do not claim instant cross-chain without polling.
4. **Confirm** with user: full recipient, amount, token, chain, irreversible — then `resolve_transfer_recipient` (for @cai.com) or state raw `to_address`.
5. **Only after explicit yes:** `POST /wallet-custodial-transfer` (`transfer`, scope `pay` or `full`).
6. **Proof:** `transfer_status` + `wallet_activity_list`; optional `mail_inbox_summarize` for billing/receipt mail to **@cai.com** (scope `mail` or `full`).

**Do not claim:** CAI pays arbitrary SaaS card invoices without user action on PSP pages; universal checkout on any website (`pay_for_agent_site` remains **guided** / gap). **Do not** ask users to paste `cai_` API keys in chat except one-time setup confirmation (see [identity-mcp-openclaw.md](./identity-mcp-openclaw.md)).