Getting started
From access link to your first authorized payment. Most teams finish in under an hour.
1. Get your owner key
- Enterprise: you'll receive a one-time access link by email. Open it, click Show my key, and save the owner key in your password manager. It's shown once, and we never see it. The link works once and expires after 7 days.
- Builder or Business: after checkout, your owner key is shown on the confirmation page, with a download button.
The owner key signs you in at /account. Keep it private: it can do everything, including inviting people.
2. Invite your team
On the account page, under People, invite colleagues with the role they need:
| Role | For | Can |
|---|---|---|
| Viewer | Finance, auditors | See everything, change nothing |
| Approver | Operations | Also approve or deny payments waiting for review |
| Admin | Engineering | Also create agents and change settings |
| Owner | You | Also invite people and manage billing |
Each person gets their own one-time link and their own key, which you can remove at any time. On Enterprise you can instead connect your identity provider (Identity tab): people sign in with their company login and SCIM adds and removes them for you.
3. Create an agent
On the Agents tab, click New agent and create one key per agent. Pick a policy template (Business+) or set what it's allowed to do:
- Allowed sellers (leave blank for any monitored endpoint)
- Max per payment, daily limit, monthly limit
- Team and owner, for reporting
- IP allowlist, if the agent runs from fixed addresses
- Test key, while you're integrating
The agent key is shown once. Give it to the agent, never your owner key. Prefer no keys at all? See key-less sign-in.
4. Register the agent's wallet
Open the agent → Wallets, enter the address it pays from and sign the message shown (free, moves no funds). From then on you'll see every x402 payment it makes, and get an alert for any that didn't go through PayCheck.
5. Integrate
The simplest way is our npm package, which checks every payment and never signs one PayCheck denied:
const client = withPayCheck(new x402Client().register(/* your scheme */), { agentKey: process.env.PAYCHECK_AGENT_KEY });Not on Node? Before each payment your agent asks PayCheck and only pays on "allow". The integration guide has copy-paste code; the core call is:
curl https://lumierepaycheck.org/v1/authorize \
-H "Authorization: Bearer $PAYCHECK_AGENT_KEY" -H "content-type: application/json" \
-d '{"url":"https://api.seller.example/data","amount":"10000","payTo":"0xSELLER_WALLET"}'6. Set company controls
On the Policies tab:
- Alert email and webhook for budget warnings and unusual spending
- Company blocklist of sellers or wallets you never want to pay
- Security tool streaming if you use a SIEM
- Payment rules: what to do with High-risk agents, auto-freeze after a payment made despite a deny, and whether small payments may go ahead if PayCheck can't be reached
Optional, on the Identity tab: turn on agent credentials so sellers can recognize your agents as belonging to your verified company.
Enterprise clients can also have company-wide caps, allowed networks, and custom limits set for their workspace.
7. Go live
Replace test keys with live keys, confirm a few decisions under Payments → Recent decisions, and click Verify audit trail (Activity) to see the chain intact. The Overview lists anything that needs you. If anything looks wrong, freeze one agent from its panel, or use the freeze switch to pause every agent instantly.