Skip to main content
You run the model and the agent framework. WalletSuite operates the MCP runtime, tools, and financial execution controls. Your agent reaches them with a short-lived token, obtained from the agent’s key on your server. What it can do and what it can sign are bound to the agent — they are not carried in the key.
The agent’s key is its identity — a scoped, revocable credential held on your server. It never reaches the model, the browser, a prompt, or any downstream MCP call. Only a short-lived token does.

​
Flow

1

Provision an agent

Provision an agent from your dashboard. You receive an agentId and one dedicated key — the anchor for the agent’s quota, billing, and revocation. Revoke it to cut the agent off. See Credentials & Authentication.
2

Authorize with the key

Your server uses the agent’s key to obtain a short-lived token for the connection. WalletSuite’s token provider handles this — the raw key stays on your server, and the token is refreshed before it expires.
3

Connect the MCP client

Attach the token as Authorization: Bearer <token> on your MCP client, pointed at the hosted endpoint. The agent sees only its bounded tool surface.

​
Connect

Point your MCP client at the hosted endpoint and attach the token. This works for any framework or custom runtime that speaks MCP over HTTP.
The token is short-lived and opaque — your client attaches it and refreshes it, and never needs to parse or persist it. The key is the durable secret; the token is disposable.

​
Managed and embedded assistants

Managed and embedded assistants are authorized by WalletSuite’s own server after an assistant-invoker binding check. Your app code selects the assistantId — never the model — and the model never sees a key or a token.

​
Next

Agents & Authority

The five bound things that make an agent, and why the model never authorizes.

Execution Levels

What a connected agent can do, from read-only to signing.

Policy Gates

Deny-by-default rules that decide what an agent is allowed to sign.

Choose Your Surface

The five surfaces of the one hosted platform.