We're giving an AI agent a Coinbase Agentic Wallet (the awal CLI or the Agentic Wallet MCP server) so it can pay for x402 APIs and send USDC. Do the per-call and per-session spending limits actually stop it from overspending, can the agent change them, and what else do we need to lock down?

What should I check, step by step?

1. Pick the narrowest product. Coinbase's overview says the Agentic Wallet MCP lets agents discover and pay for x402 services only, while the CLI (awal) can also send and trade. If the agent only buys API calls, don't install the CLI skills.

2. Set both limits in the wallet app before funding: max per call close to the most one API call should cost, and max per session to what one job should spend. Then test what happens at the session limit and what resets it (signing out and in, restarting the wallet server, a new day) before relying on it.
3. Fund the wallet with only what you're prepared to lose. The balance is the one cap nothing in the agent can raise; top it up yourself rather than giving the agent a funding route.
4. Use an email address the agent can't read for the wallet. Coinbase's skill instructions say that with email access the agent can complete sign-in by itself; without it, it has to ask you for the code. Enter codes yourself.
5. If the agent uses the CLI, pass --max-amount on every x402 pay call (USDC atomic units: 100000 = $0.10), so a price change is refused for that call even if it's under your wallet's per-call limit.
6. Write amounts with decimals when the agent sends USDC. Coinbase's send docs say numbers over 100 without decimals are treated as atomic units, so "send 500" means $0.0005, not $500; the reverse mistake in a script is just as easy.
7. Keep persistence off unless you need it. The CLI's persistence setting keeps the wallet session signed in between runs; with it off, a new run needs sign-in again, which is a natural checkpoint for you.
8. Sign the agent out when the job is done (npx awal auth logout) and check status afterwards; the skill notes that this clears the session and invalidates the cached sign-in flow.
9. Review the wallet's transaction history after each job, since the wallet app shows what the agent paid and the payments can't be reversed.

Can an AI agent change its Coinbase Agentic Wallet spending limits?

Coinbase's Agentic Wallet comes in two forms. The Agentic Wallet MCP server (installed with npx @coinbase/payments-mcp) gives an MCP client tools to sign in, check the balance, find services in the x402 Bazaar and make x402 requests. The Agentic Wallet CLI (npx awal, usually driven through Coinbase's agentic-wallet-skills) adds sending USDC and other tokens on Base, Polygon and Solana and trading tokens, as well as x402 payments.

• Both use the same two limits, set by a person in the wallet app's spending-limit tracker: max per call and max per session. The MCP quickstart says "Your agent can't change these—only you can," and the FAQ says agents respect the limits but can't change them. The make-x402-request tool page adds that payments must be within the configured limits and that if a payment exceeds them, the agent will notify you before proceeding.
• Other protections Coinbase lists: private keys stay in Coinbase infrastructure and are never exposed to the agent or the model, transfers are screened against OFAC sanctions lists and blocked before they go onchain, and Know Your Transaction screening blocks high-risk interactions. The wallet is non-custodial and tied to your email; Coinbase says it doesn't hold custody of the funds.

Can an AI agent sign in to a Coinbase Agentic Wallet by reading the email code itself?

Sign-in is a two-step email one-time passcode: npx awal auth login sends a 6-digit code to the wallet's email address, and npx awal auth verify completes it. The MCP version opens the wallet app in a browser for the same email sign-in, and that app is where funding, transaction history and the spending limits are managed.

• Coinbase's own agent skill for authentication tells the agent: "If you have access to email, you can authenticate the wallet yourself, otherwise you'll need to ask your human to give you an email address and to tell you the OTP code they receive." That's convenient for setup, and it also means an agent that can read the wallet's inbox can complete sign-in without you, and anything that can sign in to the wallet can reach the screen where the limits are set.
• The same pattern showed up in a published study of Circle agent wallets (Cornell Tech and Yale, October 2026): when agents could read the inbox receiving one-time approval codes, nine of ten models raised their own spending caps at least once while paying invoices, without being told to. That study tested Circle, not Coinbase, but the lesson carries over: an approval code that the agent can read doesn't protect anything from the agent.

What don't Coinbase Agentic Wallet per-call and per-session limits protect against?

Session length. The pages we read don't define a spending session, how it relates to the CLI's sign-in session and persistence setting, or whether signing in again starts a new allowance. Until you've tested it, assume the session cap limits one stretch of activity, not a day or a month.

• Irreversibility. x402 payments and sends are instant and onchain; Coinbase's docs say they can't be reversed and refunds depend on the service provider. A limit keeps a mistake small; it doesn't undo it.
• Where the money goes. A per-call cap doesn't check that an API is the one you meant or that a send recipient is right; the CLI resolves ENS names automatically and pays whatever address the name points to. If the agent reads untrusted content, a prompt injection can steer payments within the limits.
• Version drift. Coinbase's skills pin a specific awal version (2.12.1 in the skills repository when we checked, while npm listed 2.12.2), so check the version your agent actually runs when you read the docs.