> ## Documentation Index
> Fetch the complete documentation index at: https://docs.walletsuite.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Your Agent

> Run your own model or framework: authorize your agent with its key and connect it to the hosted WalletSuite MCP endpoint.

You run the model and the agent framework. WalletSuite operates the MCP runtime, tools, and financial execution controls. Your agent reaches them with a short-lived token, obtained from the agent's key on your server. [What it can do](/ai-agents/execution-levels) and [what it can sign](/core-concepts/policy-gates) are bound to the agent — they are not carried in the key.

<Info>
  The agent's key is its [identity](/core-concepts/agents-and-authority) — a scoped, revocable credential held on your server. It never reaches the model, the browser, a prompt, or any downstream MCP call. Only a short-lived token does.
</Info>

## Flow

<Steps>
  <Step title="Provision an agent">
    Provision an agent from your dashboard. You receive an `agentId` and one dedicated key — the anchor for the agent's quota, billing, and revocation. Revoke it to cut the agent off. See [Credentials & Authentication](/getting-started/prerequisites/credentials-and-authentication).
  </Step>

  <Step title="Authorize with the key">
    Your server uses the agent's key to obtain a short-lived token for the connection. WalletSuite's token provider handles this — the raw key stays on your server, and the token is refreshed before it expires.
  </Step>

  <Step title="Connect the MCP client">
    Attach the token as `Authorization: Bearer <token>` on your MCP client, pointed at the hosted endpoint. The agent sees only its bounded tool surface.
  </Step>
</Steps>

## Connect

Point your MCP client at the hosted endpoint and attach the token. This works for any framework or custom runtime that speaks MCP over HTTP.

```json theme={null}
{
  "mcpServers": {
    "walletsuite": {
      "url": "https://mcp.walletsuite.io",
      "headers": {
        "Authorization": "Bearer <token>"
      }
    }
  }
}
```

<Note>
  The token is short-lived and opaque — your client attaches it and refreshes it, and never needs to parse or persist it. The key is the durable secret; the token is disposable.
</Note>

## Managed and embedded assistants

<Note>
  Managed and embedded assistants are authorized by WalletSuite's own server after an assistant-invoker binding check. Your app code selects the `assistantId` — never the model — and the model never sees a key or a token.
</Note>

## Next

<CardGroup cols={2}>
  <Card title="Agents & Authority" icon="user-shield" href="/core-concepts/agents-and-authority">
    The five bound things that make an agent, and why the model never authorizes.
  </Card>

  <Card title="Execution Levels" icon="layer-group" href="/ai-agents/execution-levels">
    What a connected agent can do, from read-only to signing.
  </Card>

  <Card title="Policy Gates" icon="shield-check" href="/core-concepts/policy-gates">
    Deny-by-default rules that decide what an agent is allowed to sign.
  </Card>

  <Card title="Choose Your Surface" icon="signs-post" href="/ai-agents/choose-your-setup">
    The five surfaces of the one hosted platform.
  </Card>
</CardGroup>