MoonPay Launches Crypto Payment Vault for ChatGPT and Claude
MoonPay has launched PayBox, a payment vault that lets ChatGPT and Claude initiate crypto payments and blockchain transactions under limits set by the user.
Key Takeaways
- Wallet keys are split across hardware-isolated enclaves, so no single party can sign alone.
- Passkeys, spending limits and a kill switch are designed to prevent unrestricted AI spending.
- A transaction submitted under a valid permission counts as authorized, even if the user never saw it.
- The rollout covers Solana and EVM networks, with x402 enabling direct payments for APIs.
The product closes a gap that has constrained AI agents until now. An assistant can find a token, compare swap routes, identify a paid data service or locate a restaurant, then stops at the financial step and hands the user off to a separate wallet, exchange or checkout page.
PayBox connects payment authority directly to the assistant, letting it execute an approved action from inside the conversation. Users install it as a custom connector, register a passkey and fund the vault from a bank account or crypto wallet.
The scope runs wider than crypto. Fortune reports that PayBox handles Amazon orders, Resy restaurant reservations and flight bookings through an agent-facing service called Brij, alongside token swaps and DeFi interactions. Card payments route through Visa’s agentic commerce protocol, keeping the raw card number out of the agent’s hands entirely.
PayBox Is a Permission Layer, Not a Custodial Wallet
MoonPay describes PayBox as an “agents-first credential vault.” Users connect wallet keys, payment methods or other credentials once, then decide which agent can access them and what it may do.
The security model rests on key splitting. According to MoonPay’s announcement, wallet keys are divided using multi-party computation across hardware-isolated enclaves, leaving no device, session or party, MoonPay and the AI agent included, able to sign alone. A compromised phone yields an attacker fragments too incomplete to use. The infrastructure comes from Sodot, a key-management company MoonPay acquired earlier this year, which it says already secures more than 10 million wallets.
The precise arrangement matters, because “non-custodial” covers a range of designs. MoonPay’s earlier agent tooling kept private keys on the user’s own device. PayBox distributes fragments across enclaves instead, removing single-device compromise as a failure mode while creating a dependency on the enclave infrastructure.
Funds move directly between the user’s funding source and the merchant, wallet, protocol or recipient. When an agent requests an approved wallet operation, PayBox returns a signature, signed message or transaction hash. For card payments, it supplies a limited token or virtual card.
PayBox also connects to self-custodial wallets, where MoonPay cannot reset or reconstruct the private keys. The user keeps control and carries the full burden of securing access.
Passkeys and Spending Rules Keep Humans in Control
Delegating money to an assistant carries a different weight from asking it to summarize a document. A wrong answer gets corrected; a wrongly signed onchain transfer usually stands.
PayBox places authorization rules between the assistant and the funding source. Access sits behind a passkey, with each approval scoped to a single action and expiring after use, so a captured or replayed approval stays useless.
Separate permission settings apply to each connected agent, across three broad levels:
- Approval for every action: the assistant prepares the transaction, the user authorizes it.
- Approval above a limit: smaller transactions proceed automatically, larger ones require confirmation.
- Autonomous operation within boundaries: the agent acts independently inside a defined amount, network, service or permission scope.
Approval binds to the specific operation presented. Change the recipient, amount or details and PayBox demands fresh authorization. Users can revoke an individual agent’s access or trigger a kill switch suspending every connected agent if a device or credential looks compromised.
Who Owns a Transaction the User Never Saw
One clause in MoonPay’s terms deserves more attention than the security architecture around it. An operation submitted through a valid permission counts as authorized by the user, whether or not the user reviewed it.
That follows necessarily from autonomous mode. A permission system demanding human review of every action would defeat the purpose of granting the permission. It also relocates the risk in a way the marketing language leaves unstated.
The practical case is simple. A user grants an agent authority to spend up to $200 on API access, the agent spends it badly, and every transaction remains valid under the permission granted. The loss sits with the user, who reviewed none of them.
Card payments retain some recourse through chargebacks. Onchain transfers settle permanently, so the autonomous tier carries different consequences depending on which rail the agent uses. A user can set a generous crypto limit without ever encountering that distinction.
Crypto Payments, Swaps and Paid APIs From One Chat
PayBox stays out of execution when an agent requests a swap. It passes the authorized instruction to the connected wallet, protocol or trading service, and the result depends on liquidity, the smart contract used, the quoted price and the chosen network.
The initial blockchain rollout covers Solana and EVM-compatible networks, placing Ethereum, Base and Arbitrum inside one technical environment, though available assets and services differ between them.
Multi-chain support matters because agent payments serve different purposes. A consumer purchase may draw on a card or bank-funded credential, while a swap needs an onchain wallet. Payments for data, compute or individual API calls suit stablecoins, since conventional checkout systems handle amounts worth a few cents badly.
How x402 Lets an AI Agent Pay an API
PayBox integrates with x402, an open payment standard built around the HTTP 402 “Payment Required” response.
The mechanism folds payment into an ordinary request between an agent and an online service:
- The agent requests access to an API, dataset, article or other digital resource.
- The service returns a 402 response containing the price, payment asset, network and destination.
- The agent checks whether the payment fits inside its approved PayBox limits.
- PayBox supplies the authorized signature or payment credential.
- The agent resubmits with proof of payment and receives the resource.
The service skips creating a customer account, selling a subscription or asking the agent to preload credits. Each request carries its own price, payable in stablecoins on supported networks.
As we previously explained in our analysis of stablecoins as a potential payment rail for AI agents, x402 suits machine-to-machine commerce specifically. Software discovers a service, reads its price, pays within an approved budget and consumes the result without pausing for a human checkout.
The standard governs how a service requests payment and how an agent proves it, leaving wallet, stablecoin and settlement network variable and routing nothing through MoonPay by default.
MoonPay Is Not First, but It Is Structured Differently
Agent funding tools already exist. Fortune notes that Robinhood and Coinbase both offer ways to give agents spending capacity, with MoonPay’s distinction being decentralization and independence from the company’s own permissions.
That difference is real and narrower than it sounds. A user still depends on MoonPay’s enclave infrastructure, on its connector remaining available inside ChatGPT and Claude, and on its terms governing what a valid permission authorizes. Decentralized key management removes one dependency while leaving the platform in place.
The Security Controls Do Not Remove Transaction Risk
PayBox solves the authorization problem more directly than the judgment problem.
An agent may hold permission to swap up to $100 of USDC while selecting the wrong token contract, accepting poor execution or interacting with a malicious protocol. A reservation lands on the wrong date. An API payment buys data that misses the point of the request. Each is correctly authorized and a bad outcome.
Coverage has limits too. A service must expose an agent-accessible payment route, connector or x402 endpoint before an assistant can transact with it. Funding a wallet leaves an ordinary website exactly as incompatible as before.
Controlled delegation is therefore the realistic early model. Small, repetitive, tightly bounded transactions suit the autonomous tier; larger swaps, unfamiliar contracts and irreversible transfers belong behind manual approval.
PayBox moves AI assistants closer to acting inside crypto instead of describing it. Whether that becomes a real payment market depends on how many wallets, protocols, APIs and merchants adopt compatible connectors, and on whether users trust an agent enough to let it sign.
- Disclaimer: This article is for informational purposes only and does not constitute financial, investment or legal advice. Descriptions of PayBox’s security architecture and permission model reflect MoonPay’s own published statements and have not been independently tested. Users should review the current product terms before granting an AI agent spending authority.
- Methodology: The analysis uses MoonPay’s launch announcement, Fortune’s reporting on PayBox’s consumer integrations and competitors, the published x402 specification, MoonPay’s product terms and Coindoo’s earlier coverage of stablecoin payment rails for AI agents.
Alex is Editor-in-Chief of Coindoo and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
