Architecture
How the pieces fit — one rail, two payers, and where each secret lives.
The system
Three trust boundaries, three keys:
sk_…never leaves your server — it mints signed intents, so the browser can never change a price.pk_…is public — it scopes the SDK's checkout calls to your merchant account, and settlement reporting also demands the buyer's own identity token.agent_sk_…lives only in thetab-mcpproxy environment — the AI agent itself never sees a key, and the cap is enforced outside the model.
Human checkout (test mode)
Agent x402 payment
The design rule everywhere: money truth is recorded evidence — settled means an on-chain hash, blocked means a recorded reason, and the model never holds the pen.