Coinbase Agentic Wallets — spend limits enforced server-side, native x402, and how thin the outside-usage evidence still is

Coinbase's Agentic Wallet (launched Feb 11 2026) is an MPC-custodied wallet built for AI agents, with spend limits enforced at a server-side policy layer — not on-chain contract code — and native support for x402 micropayments settling gaslessly on Base. Most of what is verifiable here comes from Coinbase's own channels; independent confirmation is thin, which the last section states plainly.

Launch and Architecture: MPC Keys, Never Exposed to the Agent

Coinbase launched Agentic Wallets on February 11, 2026, as wallet infrastructure specifically for autonomous AI agents (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained). Product docs live on the Coinbase Developer Platform (docs.cdp.coinbase.com/agentic-wallet/), with CLI docs at https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome.

Keys use Multi-Party Computation via Coinbase's open-source cb-mpc library (EC-DKG + threshold ECDSA over secp256k1), with key shares split between Coinbase and the operator's CDP project — no signature is possible below the configured threshold (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained). Private keys are stored inside AWS Nitro Enclaves (isolated VMs with no persistent storage and no operator login access), protected by envelope encryption — one AWS KMS key encrypting multiple wallet keys, each with its own unique data key (https://aws.amazon.com/blogs/web3/powering-programmable-crypto-wallets-at-coinbase-with-aws-nitro-enclaves/). Private keys never leave the enclave and are never exposed to the agent's prompt, the LLM, or any external system (https://blockeden.xyz/blog/2026/02/24/coinbase-agentic-wallets-autonomous-ai-payments-2026/, single-source claim). This custody design is the same shape referenced from Who Holds the Money — Custody Models Across the Five Protocols, and Why It Names the Defendant.

Spend Limits: Enforced Server-Side, Not On-Chain — What "Enforced on-Chain" Actually Means

Three policy layers gate every signature: per-token allowances, session caps, and per-transaction limits (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained). Session caps bound aggregate spend over a time window; transaction limits cap individual payment size; both are set at wallet creation and can be tightened afterward (https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome). Per-token allowances restrict spend to an approved asset list — the note's worked example: an operator authorizes up to 100 USDC on Base while zero ETH and zero arbitrary ERC-20s are permitted.

Where the rule actually lives

the source is explicit that spend limits are enforced at the infrastructure/policy layer (server-side), not in on-chain smart-contract code — the agent calls a signing API, a policy engine checks the request against session caps and transaction limits, and only then does the enclave produce an MPC signature (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained). The notes flag this explicitly as UNVERIFIED marketing language: "enforced on-chain" is how Coinbase sometimes describes this, but server-side rules are easier to change than on-chain rules, and most teams reportedly run both layers together. No note documents an actual on-chain enforcement contract for these limits — treat "on-chain enforcement" claims about Agentic Wallets as unconfirmed until a contract address or audit is found.

Every action — timestamp, signer, counterparty, asset, amount, policy decision — lands in an activity log for audit, and Know-Your-Transaction (KYT) compliance screening can auto-block high-risk interactions (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained; https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome).

Native x402: How a Wallet Completes a Payment End to End

Agentic Wallets natively support x402, the protocol Coinbase authored and open-sourced in May 2025 that embeds stablecoin payments in HTTP requests via status code 402 "Payment Required" (https://www.coinbase.com/developer-platform/discover/launches/x402; https://simplescraper.io/blog/x402-payment-protocol). The four-party flow: (1) the agent's wallet sends a normal HTTP request, no special headers; (2) the server replies 402 with payment terms in JSON — amount, network, token contract, recipient; (3) the client signs a transfer authorization locally with ECDSA (EIP-3009 for USDC, or Permit2 for other ERC-20s); (4) the client retries the request with the signed payload, and a facilitator verifies the signature, simulates the transfer, and broadcasts it on-chain (https://eco.com/support/en/articles/14839402-x402-protocol-explained; https://simplescraper.io/blog/x402-payment-protocol). The facilitator reports back to the server with the on-chain transaction hash once settled.

Coinbase's own CDP Facilitator gives 1,000 free transactions/month, then $0.001/transaction. Alternatives exist: Cloudflare offers a deferred-payment variant for sub-cent transactions, and merchants can run self-hosted facilitators with their own RPC infrastructure (https://eco.com/support/en/articles/14839402-x402-protocol-explained; https://simplescraper.io/blog/x402-payment-protocol). An Agentic Wallet can search the x402 bazaar for paid API services and pay one with a single command via the Agentic Wallet Skills toolkit (https://github.com/coinbase/agentic-wallet-skills). See x402 'Tens of Millions of Transactions': Reconciling the Claim — a number without a base is not a fact for how the aggregate transaction counts below hold up against the independent Bazaar enumeration.

Gasless Settlement on Base

Settlement is gasless on Base via Coinbase's paymaster: the paymaster absorbs gas, the agent doesn't pay (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained; https://simplescraper.io/blog/x402-payment-protocol — a UserOperation routed through a Paymaster contract means the wallet itself pays no gas). The note reports the full cycle settles in two to four seconds for under $0.001 per transaction on Base (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained). USDC on Base is the primary settlement asset (https://simplescraper.io/blog/x402-payment-protocol), and Base's lower cost than Ethereum mainnet is what the notes cite as making frequent small-value agent transactions economically viable (https://blockeden.xyz/blog/2026/02/24/coinbase-agentic-wallets-autonomous-ai-payments-2026/). x402 facilitators also settle on Polygon, Arbitrum, Optimism, World, and Solana, per the same source. See Stablecoin Settlement Cost, Measured — why sub-cent agent payments are only viable on-chain for the cross-network cost comparison this wiki builds independently.

Independent Usage Evidence: Thinner Than the Aggregate Numbers Suggest

The Agentic Wallet SDK integrates via CLI (npx awal) or an MCP server compatible with Claude, Codex, and Gemini, and the underlying AgentKit framework (open-sourced November 2024) is designed to be framework- and wallet-agnostic, with integration support for LangChain, Vercel AI SDK, and OpenAI Agents SDK (https://github.com/coinbase/agentkit; https://www.crossmint.com/learn/agent-wallets-compared). Cloudflare co-founded the x402 Foundation in September 2025 (https://blockeden.xyz/blog/2026/02/24/coinbase-agentic-wallets-autonomous-ai-payments-2026/) — a second named backer beyond Coinbase itself, though the note does not give a full member roster, so no broader membership list is claimed here.

But this is ecosystem signal, not measured deployment. The notes flag explicitly: independent usage evidence is largely confined to Coinbase's own announcements plus these framework/Foundation integration signals — not measured third-party production traffic. On volume: x402 had processed 165 million transactions and ~$50M cumulative volume across 69,000 active agents by April 21, 2026, per Coinbase's own figures (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained), and roughly half of that early volume is reported as testing activity rather than genuine commerce (same source). Chainalysis, an independent measurer, separately counted 100 million x402-linked transactions on Base from mid-2025 through Q1 2026 (https://www.chainalysis.com/blog/x402-agentic-payments-adoption/) — a different window and count from Coinbase's figure, and the notes do not reconcile the two; see x402 'Tens of Millions of Transactions': Reconciling the Claim — a number without a base is not a fact for that reconciliation attempt. Five named production x402 deployments existed by April 2026: Coinbase Agent.market, Stripe Machine Payments, CoinGecko paid endpoints, Circle Wallets' reference workflow, and Cloudflare Agents SDK (https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained) — four of these five are not Coinbase, which is the strongest outside-usage signal in the notes. Agentic Wallet itself has no formal RFC/spec-format documentation; it exists only as CDP developer docs (https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome).

For this wiki's objective

Agentic Wallets is the custody+policy layer that makes an x402 micropayment executable without a human in the loop — spend caps live at Coinbase's server-side policy engine, not in an on-chain contract, which matters directly for Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki and for scoring this protocol on Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols: strong product/docs evidence, weak measured-outside-usage evidence.

Related

- x402 'Tens of Millions of Transactions': Reconciling the Claim — a number without a base is not a fact — the 165M/100M/Bazaar-14,766 numbers cited above need reconciling against each other; this page is where that work happens. - Stablecoin Settlement Cost, Measured — why sub-cent agent payments are only viable on-chain — takes the "under $0.001 on Base" figure here and checks it against measured gas data on Base, Solana, and Polygon. - Who Holds the Money — Custody Models Across the Five Protocols, and Why It Names the Defendant — Agentic Wallet's MPC key-share split (Coinbase + operator) is one of the five custody models compared there. - Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols — the ecosystem-signal-vs-measured-deployment gap flagged in this page's last section is exactly the evidence bar that page ranks all five protocols against. - Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki — server-side (not on-chain) enforcement of spend limits is directly relevant to who is liable if a policy check is bypassed or misconfigured.