Spend grants

A grant is not a wallet. It's capped, revocable authority over your existing Bazantic-hosted balance — the same balance shown under Balances in the dashboard. You approve a grant once in the browser, and from then on the device you approved it for can pay for x402 calls per request, up to the cap, only to the gateways it's scoped to. Revoke it at any time and that authority ends immediately — your balance never moves anywhere else in the meantime.

This is the recommended way to pay for calls from the terminal or from an agent. The alternative is a self-custody wallet you hold and fund yourself; see Command line for that path.

Grant vs. wallet

Prefer a grant unless you specifically want to self-custody the paying key.

Dashboard QuickStart

The Dashboard links to Authorize an agent at /developer/spend. This QuickStart always uses your personal account, even when an organization is active.

An active personal grant completes the QuickStart. Funding the balance and the first payment request are optional after activation. Organization requests remain in Organization settings.

Create a grant

baz grant create --name agent-1 --cap 5

The CLI mints a key pair for this device, prints its fingerprint, and opens an approval URL (or prints it, under a pipe or in CI). The browser page reads, in substance, "Authorize Bazantic CLI on <this device> to spend up to $5 USDC on Base or Base Sepolia, only to Bazantic gateway addresses, until <expiry date>."

Check the fingerprint shown in the browser against the one the CLI printed before you approve — that's the proof the approval belongs to the device that asked for it. Approving finishes the command; the CLI polls until the grant is active.

How it connects to your Bazantic balance

A grant is not a second pot of money. It adds a signer to the wallet that backs your dashboard balance. The Privy policy limits each signing request. The Bazantic relay enforces the recipient, network, USDC token, total cap, and scope. The relay forwards a device-signed request. It does not add signing authority.

There is no separate "grant balance" to track — spend against a grant draws down the same balance you'd see at Balances, and it stops working the moment that balance runs out, the cap is reached, or the grant expires or is revoked.

Pay an external x402 recipient

Use --any-service only when the task needs a broad external recipient permission.

baz grant create --name external-agent --any-service --cap 5

For one service, pin the recipient and request cap:

baz grant create --service https://stabletravel.dev --recipient 0x1111111111111111111111111111111111111111 --network base --name flights --cap 0.10 --max-per-request 0.05

The relay enforces the recipient, network, USDC token, request cap, and total cap. The origin is an approval label and a CLI request check. It does not prove that an x402 challenge came from that origin. External grants are personal. Organization grants cannot use these scopes.

Connect it to your terminal

"Connecting" a grant to a machine is the key pair baz grant create mints for it. The private half never leaves that machine — approving in the browser only tells Bazantic to trust its public half, up to the cap. Run baz grant create again with a new --name on another machine (a CI runner, a second laptop, an agent's sandbox) and it gets its own key, its own approval, and its own line in your grant list — so you can revoke a compromised laptop without touching a CI credential that lives elsewhere.

The key is stored with mode 0600. Treat it as a secret because it can spend within the remaining cap and scope. Do not paste it into a prompt, log, or source file. Revoke the grant if the key leaves the intended device. For a headless environment, inject BAZANTIC_GATEWAY_DEVICE_KEY through the environment instead of a command argument.

Call an x402 service with a grant

baz curl https://<your-gateway>/<path> --account agent-1 --max-amount 0.02 --json

baz curl sends the request, and on a 402 it reads the price, checks it against --max-amount (default 0.01, and the check happens before anything is signed), signs the payment with the named grant, and retries the same signed payment — never a new one — automatically. A 402 is a hard stop only when the price itself exceeds your ceiling.

• --account <name> picks which grant pays. Required once you have more than one.

• --max-amount is the per-call ceiling, inclusive: a call priced at exactly the ceiling goes through.

• --yes skips the interactive confirmation. The ceiling is still enforced either way.

• Use --yes only for a task that the user approved for unattended execution.

• The per-call ceiling is not a task budget. The grant cap limits total authorized spend.

• --verbose prints the settlement receipt to stderr:

  ✓ paid 0.0001 USDC · payer 0xF39F...
    receipt cmVjZWlwdA==

--json returns { ok, status, paid, body } — paid carries transaction, network, and explorerUrl, and the upstream response is .body.

One standard grant supports Base and Base Sepolia under one shared cap. A sandbox gateway selects Base Sepolia. The registration network does not restrict gateway or broad grant payments.

Manage your grants

baz grant list --json    # this device's credentials: cap, network, scope, expiry, status
baz grant revoke agent-1

baz grant revoke asks for confirmation. A run with no terminal must pass --yes.

baz grant list asks the server for each credential's real status, so a grant revoked from the dashboard shows up here too. A grant moves through pending while it waits for browser approval, to active once approved, and ends at denied, revoked, or expired — all final. There is no spend total in the listing; track spend as calls × price, or read it from Balances.

Command summary

baz grant create --name <n> [--cap <usdc>] [--network base|base-sepolia]
baz grant create --service <slug> [--cap <usdc>] [--network base|base-sepolia]
baz grant create --any-service --name <n> --cap <usdc> [--network base|base-sepolia]
baz grant create --service <https-origin> --recipient <0x-address> --network base|base-sepolia --name <n> --cap <usdc> --max-per-request <usdc>
baz grant list [--json]
baz grant revoke <name> [--yes] [--json]
baz curl <url> --account <name> [--max-amount <usdc>] [--yes] [--verbose] [--json]

See Command line for the rest of the CLI, including the self-custody wallet path and gateway management.