Fund the wallet and grant agent permissions

After you create a payment instrument, the end user must fund the wallet with USDC and grant the agent permission to sign transactions. Until both steps are complete, the process payment operation fails with a client-side exception.

Coinbase CDP

When you create a payment instrument with the Coinbase CDP connector, the CreatePaymentInstrument API returns a redirectUrl pointing to the Coinbase WalletHub, a portal to grant agent permissions and fund the wallet. Direct the end user to this URL to fund their wallet and grant agent permissions from a single interface.

Use the WalletHub URL

The redirectUrl from the CreatePaymentInstrument response opens the Coinbase WalletHub, where the end user can fund the wallet and grant signing permissions to the agent.

instrument = dp_client.create_payment_instrument(
    userId="test-user-123",
    paymentManagerArn=PAYMENT_MANAGER_ARN,
    paymentConnectorId=PAYMENT_CONNECTOR_ID,
    paymentInstrumentType="EMBEDDED_CRYPTO_WALLET",
    paymentInstrumentDetails={
        "embeddedCryptoWallet": {
            "network": "ETHEREUM",
            "linkedAccounts": [{"email": {"emailAddress": "user@example.com"}}]
        }
    },
    clientToken=str(uuid.uuid4()),
)

# Direct the end user to this URL
wallet_hub_url = instrument["paymentInstrumentDetails"]["redirectUrl"]
print(f"Open the WalletHub: {wallet_hub_url}")

Alternatively, you can deploy the Coinbase AgentCore template on GitHub as a self-hosted Next.js frontend that provides the same funding and permissions functionality with a customizable UI. See (Alternative) Deploy the self-hosted frontend for setup instructions.

Fund the wallet

From the WalletHub (or the self-hosted frontend), the end user can fund their wallet using any of the following methods:

For testnet environments, fund the wallet with testnet USDC from the Circle USDC faucet.

Grant agent permissions

Agent permissions in Coinbase CDP use wallet-scoped delegation—each wallet receives its own independent, time-bound grant from the end user that authorizes the agent to sign transactions.

Once granted, the agent can sign transactions on behalf of the end user’s wallets until the grant expires. The end user can revoke permissions at any time from the same dashboard. Once the grant is provided, proceed to Create a payment session.

Revoke permissions

The end user can revoke agent access to any wallet at any time from the permissions section of the WalletHub or frontend dashboard. After revocation, the agent can no longer sign transactions for that wallet until the user grants new permissions.

(Alternative) Deploy the self-hosted frontend

If you need a customizable UI instead of the hosted WalletHub, deploy the Coinbase AgentCore template as a self-hosted Next.js application.

The self-hosted frontend provides the same funding and permission-granting flows described above, with full control over styling and user experience.

Stripe (Privy)

The Privy AgentCore SDK on GitHub is a Next.js reference frontend that enables end users to authenticate, fund wallets, and grant agent permissions through a guided setup flow.

Deploy the frontend

Fund the wallet

When the end user authenticates through the Privy frontend, embedded wallets are automatically created for both Base (EVM) and Solana networks. The end user can fund their wallet using any of the following methods:

For testnet environments, fund the wallet with testnet USDC from the Circle USDC faucet.

Grant agent permissions

Agent permissions in Privy use session signers (also called authorization keys)—the end user registers the agent’s authorization key on each embedded wallet, granting the agent permission to sign transactions without per-transaction approval.

The frontend calls addSessionSigners from the Privy SDK to register the agent’s authorization key on each embedded wallet. The operation is idempotent—if the signer is already registered, no error is returned.

Once connected, the agent can sign transactions on behalf of the user’s wallets. The permissions persist until explicitly revoked.

(Optional) Verify agent connection

The frontend verifies that permissions are active by calling the Privy API:

GET https://auth.privy.io/api/v1/wallets/{walletId}
Authorization: Basic <base64(appId:appSecret)>

The response includes an additional_signers array. If the configured Authorization ID appears in this array, the agent is connected.

Once the grant is provided, proceed to Create a payment session.

Testing with testnet USDC

For development and testing, use testnet networks and fund wallets with test USDC: