Per-agent spend caps
Every agent carries a daily cap, a monthly cap, and a brand allowlist. Caps are checked and decremented server-side before any purchase settles, so an agent cannot exceed its budget no matter how it is prompted.
Security-first by design
Give an agent a wallet, not the keys to the account
AgentRefills is built to move money for autonomous agents without ever giving one the ability to overspend, leak a code, or pay twice. Every guarantee here is structural, enforced server-side on every money-moving call, not a setting you can forget to turn on.
Money controls
How we protect money
An agent gets its own API key with its own budget. The controls below run on our side of the call, so a compromised or confused agent still cannot spend beyond what you allowed.
Fail-closed policy
Every purchase passes a policy engine first. If that engine is unreachable or returns an undecided verdict, the request is denied, never allowed. There is no path where an evaluation failure results in a spend.
Human-in-the-loop approval
Purchases at or above a configurable threshold pause and request a human decision, pinged straight to Slack. Nothing settles until a person approves, and a rejection is returned to the agent as a clean, actionable error.
Kill switch
One global switch parks all spending. It is checked before every money-moving action, so flipping it stops new purchases immediately without leaving a half-finished payment behind.
Zero duplicate payments
Supply a client reference and a repeated call returns the existing task instead of charging again. A unique payment-per-task constraint backs it in the database, so a double charge is structurally impossible, not merely unlikely.
Full audit trail
Every purchase is reconstructable end to end from an OpenTelemetry trace paired with a double-entry ledger. You can see exactly what happened, in what order, and where each cent moved.
Secrets handling
How we protect codes & secrets
A gift card code is bearer money. We treat redemption codes and API secrets as material that must be handled once, in isolation, and never exposed anywhere it does not need to be.
-
Encrypted at rest. Codes are stored encrypted and live only inside an isolated vault. Nothing else in the system holds the plaintext.
-
Released exactly once. A code is handed over a single time through
get_code. Any later call for the same task returnsALREADY_RELEASED, so a code cannot be pulled twice. -
Never in logs or traces. Beyond that one release, a code is never written to logs, traces, or API responses. Not on success, not on error, not for debugging.
-
Secrets isolated. API secrets and redemption codes are kept separate from the rest of the application. The layer that talks to agents handles token references, never raw material.
-
IDs, not payloads. Trace attributes carry identifiers such as
task_idandinvoice_id, never the underlying values. Observability never becomes a leak.
Integrity
Integrity guarantees
The books stay consistent under retries, provider hiccups, and duplicate events, and you can prove out an integration before a single real cent moves.
Verified, deduped webhooks
Every inbound webhook is verified with an HMAC signature and deduplicated on (provider, event_id) before it is processed. A replayed or forged event changes nothing.
Ledger that sums to zero
Money is tracked in a double-entry ledger where every transaction sums to zero. Funds are never created or destroyed by a bug, and the balance always ties out.
Sandbox & test mode
A free sandbox mode exercises the entire flow with test products and zero real spend. Build, break, and retry your integration end to end before you switch to live funds.
Disclosure
Vulnerability disclosure
If you find a security issue in AgentRefills, please report it to security@agentrefills.com. We welcome responsible disclosure, will acknowledge your report, and will work with you on a fix and on timing before any details are made public. Please give us a reasonable window to remediate before sharing findings elsewhere.
Money-moving you can hand to an agent
Read how the guarantees are wired, or talk to us about your rollout. Start in sandbox and go live when you are ready.