Skip to content
Reinkey

Reinkey Reins

The agent holds the key. You hold the reins.

Reins is a smart account with its policy written on-chain. The agent pays and trades with its own key; Stellar enforces the cap, the allowed payees and the allowed pairs. Even a stolen key can't step outside the limit.

Reins quickstartWatch a rejection live
  • Daily and per-transaction caps
  • Allowed payees and trading pairs only
  • Freeze in one transaction, recall in one transaction

The agent pays. You sleep.

The agent opens a channel in one transaction, then pays for every call with a signed voucher. No sign-up, no API key, no credit card.

bash
npm i @reinkey/sdk

Over-limit transactions fail on-chain

The rejection comes from __check_auth, not from a server: with a transaction hash and a reason code anyone can verify.

agent.ts
import { ReinkeyAccount, ChannelSigner, x402Fetch } from "@reinkey/sdk";
import { randomBytes } from "node:crypto";

// The account is a contract. Its policy (caps, payees, pairs) lives on-chain.
const account = new ReinkeyAccount({ accountId, agent, relayer, ...network });

// One transaction: lock 0.05 USDC into a channel with the seller.
const voucherSecret = randomBytes(32);
const { channelId } = await account.openChannel({
  payee, deposit: 500_000n, voucherSecret,
});

// Every call after that is a signed voucher. No chain, ~1 ms.
const signer = new ChannelSigner({ channelId, secret: voucherSecret, ...channel });
const { res } = await x402Fetch("https://reinkey.onrender.com/demo/book", { signer, network });
agent.ts
// A stolen agent key tries to send funds to its own wallet.
await account.transfer(attacker, 1_000_000n);

// SorobanCallError: PAYEE_NOT_ALLOWED
// Rejected by __check_auth on Stellar, not by a server.

  • 01Policy on-chain

    Daily cap, per-transaction cap, allowed payees, allowed DEX pairs and an expiry are written inside the account. The limit holds even if a server goes down or gets compromised.

  • 02Freeze and recall

    The owner freezes the account in one transaction: from that moment the agent key can't sign anything. recall pulls the balance back whenever you want.

  • 03Bounded trading

    The agent can trade on the Stellar DEX (Soroswap); which pair, how much per trade and per day is in the policy. Trades without slippage protection are rejected. With no USDC on hand, a channel opens with XLM: just enough is converted on the DEX and the seller still receives USDC.

  • 04No XLM for the agent

    A relayer submits the transaction and pays the fee; the agent only signs the authorization entry. The only asset in the agent's wallet is USDC.

  • 05Explainable rejections

    Every rejection carries a reason code: PER_TX_CAP_EXCEEDED, PAYEE_NOT_ALLOWED, DAILY_CAP_EXCEEDED, ACCOUNT_FROZEN. Policy rejections also surface in simulation, before anything hits the chain.

  • 06Live audit

    The console shows every payment, every on-chain transaction and every rejection live; the permanent ledger is paginated and complete.

What exists today, and what doesn't

  • Runs on Stellar testnet; the contracts haven't been audited yet.
  • Accounts are deployed with a script today; one-click setup from the console is on the roadmap.
  • On-chain trade limits apply on the DEX side. The chain can't see trades inside a centralized exchange's internal ledger.

Give your agent spending power, safely.

Reins quickstartWatch a rejection live