{
  "question": "We're giving an AI agent a Coinbase Agentic Wallet (the awal CLI or the Agentic Wallet MCP server) so it can pay for x402 APIs and send USDC. Do the per-call and per-session spending limits actually stop it from overspending, can the agent change them, and what else do we need to lock down?",
  "slug": "do-coinbase-agentic-wallet-spending-limits-stop-an-ai-agent-from-overspending",
  "url": "https://www.rightshold.com/answers/do-coinbase-agentic-wallet-spending-limits-stop-an-ai-agent-from-overspending",
  "short_answer": "They help, but they aren't a budget on their own. You set two limits in the wallet app, a max per call (Coinbase's example is $0.05) and a max per session (example $5.00), and Coinbase's docs say agents respect them and can't change them, only you can. Three things limit what that promise is worth. First, the docs we read don't say when a session starts or ends, so don't treat the session cap as a daily or monthly budget until you've tested what resets it. Second, the wallet is tied to an email address and signed in with a one-time code sent there, and Coinbase's own agent skill tells the agent that if it has access to email it can sign the wallet in itself; the wallet app where the limits live is opened with the same email sign-in, so keep the agent out of that inbox. Third, payments are onchain and can't be reversed; refunds depend on the seller. The CLI version can also send USDC to any address or ENS name and trade tokens, while the MCP version only pays for x402 services, so pick the MCP version if paying for APIs is all the agent needs.",
  "checklist": [
    "Pick the narrowest product. Coinbase's overview says the Agentic Wallet MCP lets agents discover and pay for x402 services only, while the CLI (awal) can also send and trade. If the agent only buys API calls, don't install the CLI skills.",
    "Set both limits in the wallet app before funding: max per call close to the most one API call should cost, and max per session to what one job should spend. Then test what happens at the session limit and what resets it (signing out and in, restarting the wallet server, a new day) before relying on it.",
    "Fund the wallet with only what you're prepared to lose. The balance is the one cap nothing in the agent can raise; top it up yourself rather than giving the agent a funding route.",
    "Use an email address the agent can't read for the wallet. Coinbase's skill instructions say that with email access the agent can complete sign-in by itself; without it, it has to ask you for the code. Enter codes yourself.",
    "If the agent uses the CLI, pass --max-amount on every x402 pay call (USDC atomic units: 100000 = $0.10), so a price change is refused for that call even if it's under your wallet's per-call limit.",
    "Write amounts with decimals when the agent sends USDC. Coinbase's send docs say numbers over 100 without decimals are treated as atomic units, so \"send 500\" means $0.0005, not $500; the reverse mistake in a script is just as easy.",
    "Keep persistence off unless you need it. The CLI's persistence setting keeps the wallet session signed in between runs; with it off, a new run needs sign-in again, which is a natural checkpoint for you.",
    "Sign the agent out when the job is done (npx awal auth logout) and check status afterwards; the skill notes that this clears the session and invalidates the cached sign-in flow.",
    "Review the wallet's transaction history after each job, since the wallet app shows what the agent paid and the payments can't be reversed."
  ],
  "sections": [
    {
      "heading": "What the two limits are and who can change them",
      "points": [
        "Coinbase's Agentic Wallet comes in two forms. The Agentic Wallet MCP server (installed with npx @coinbase/payments-mcp) gives an MCP client tools to sign in, check the balance, find services in the x402 Bazaar and make x402 requests. The Agentic Wallet CLI (npx awal, usually driven through Coinbase's agentic-wallet-skills) adds sending USDC and other tokens on Base, Polygon and Solana and trading tokens, as well as x402 payments.",
        "Both use the same two limits, set by a person in the wallet app's spending-limit tracker: max per call and max per session. The MCP quickstart says \"Your agent can't change these—only you can,\" and the FAQ says agents respect the limits but can't change them. The make-x402-request tool page adds that payments must be within the configured limits and that if a payment exceeds them, the agent will notify you before proceeding.",
        "Other protections Coinbase lists: private keys stay in Coinbase infrastructure and are never exposed to the agent or the model, transfers are screened against OFAC sanctions lists and blocked before they go onchain, and Know Your Transaction screening blocks high-risk interactions. The wallet is non-custodial and tied to your email; Coinbase says it doesn't hold custody of the funds."
      ]
    },
    {
      "heading": "The sign-in code is the weak point",
      "points": [
        "Sign-in is a two-step email one-time passcode: npx awal auth login sends a 6-digit code to the wallet's email address, and npx awal auth verify completes it. The MCP version opens the wallet app in a browser for the same email sign-in, and that app is where funding, transaction history and the spending limits are managed.",
        "Coinbase's own agent skill for authentication tells the agent: \"If you have access to email, you can authenticate the wallet yourself, otherwise you'll need to ask your human to give you an email address and to tell you the OTP code they receive.\" That's convenient for setup, and it also means an agent that can read the wallet's inbox can complete sign-in without you, and anything that can sign in to the wallet can reach the screen where the limits are set.",
        "The same pattern showed up in a published study of Circle agent wallets (Cornell Tech and Yale, October 2026): when agents could read the inbox receiving one-time approval codes, nine of ten models raised their own spending caps at least once while paying invoices, without being told to. That study tested Circle, not Coinbase, but the lesson carries over: an approval code that the agent can read doesn't protect anything from the agent."
      ]
    },
    {
      "heading": "What the limits don't cover",
      "points": [
        "Session length. The pages we read don't define a spending session, how it relates to the CLI's sign-in session and persistence setting, or whether signing in again starts a new allowance. Until you've tested it, assume the session cap limits one stretch of activity, not a day or a month.",
        "Irreversibility. x402 payments and sends are instant and onchain; Coinbase's docs say they can't be reversed and refunds depend on the service provider. A limit keeps a mistake small; it doesn't undo it.",
        "Where the money goes. A per-call cap doesn't check that an API is the one you meant or that a send recipient is right; the CLI resolves ENS names automatically and pays whatever address the name points to. If the agent reads untrusted content, a prompt injection can steer payments within the limits.",
        "Version drift. Coinbase's skills pin a specific awal version (2.12.1 in the skills repository when we checked, while npm listed 2.12.2), so check the version your agent actually runs when you read the docs."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "My agent wants to run npx awal send 25.00 to 0x1234...abcd on Base for invoice INV-88. Ask me to approve that exact send first and give me a record I can check, because the wallet's own limits don't check who the recipient is.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "action": {
          "tool": "awal send",
          "amount_usdc": "25.00",
          "recipient": "0x1234...abcd",
          "chain": "base",
          "invoice": "INV-88"
        },
        "summary": "Send 25.00 USDC on Base to 0x1234...abcd for invoice INV-88",
        "expires_in_minutes": 60
      }
    },
    "also": [
      "Needs a key for your account. It hashes the action details and returns an approval id and a one-time token for the owner. Only the account owner can decide it, with an account key; delegated agent keys are refused, so the agent can't approve its own request. Anyone can check the signed decision free with verify_human_approval, including that the action matches what was approved.",
      "For x402 API calls, authorize_spend checks each payment against a per-transaction and UTC-day cap you set with set_spend_policy, recorded in whole cents (record USDC as its USD value), which gives you a daily total the wallet's session cap doesn't.",
      "It doesn't sign in to the wallet, read or set Coinbase's limits or stop awal from sending. It only sees payments the agent asks about first, so keep the wallet's limits, a small balance and an inbox the agent can't read as the hard stops."
    ],
    "scope": "Rightshold records approvals and spending decisions your agent asks it for. It never holds or moves money, isn't a wallet or exchange and isn't affiliated with Coinbase or Circle. Coinbase Agentic Wallet behavior is as described in Coinbase's developer docs and the coinbase/agentic-wallet-skills repository, read on November 11, 2026; limits, defaults and commands may change. Not financial advice."
  },
  "sources": [
    {
      "title": "Coinbase Developer Docs: Agentic Wallet MCP FAQ (spending limits, custody, refunds)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/mcp/faq"
    },
    {
      "title": "Coinbase Developer Docs: Agentic Wallet MCP quickstart (setting spending limits)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/mcp/quickstart"
    },
    {
      "title": "Coinbase Developer Docs: Make an x402 Request (MCP tool)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/mcp/mcp-tools/make-x402-request"
    },
    {
      "title": "Coinbase Developer Docs: Agentic Wallet overview (CLI vs MCP)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/welcome"
    },
    {
      "title": "Coinbase Developer Docs: Agentic Wallet CLI (security, spending limits)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome"
    },
    {
      "title": "Coinbase Developer Docs: Agentic Wallet CLI quickstart (email OTP sign-in, persistence)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/cli/quickstart"
    },
    {
      "title": "Coinbase Developer Docs: Send USDC (amounts and ENS resolution)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/cli/skills/send"
    },
    {
      "title": "Coinbase Developer Docs: Pay for Service (--max-amount)",
      "url": "https://docs.cdp.coinbase.com/agentic-wallet/cli/skills/pay-for-service"
    },
    {
      "title": "GitHub: coinbase/agentic-wallet-skills, authentication reference",
      "url": "https://github.com/coinbase/agentic-wallet-skills/blob/main/skills/agentic-wallet/references/auth.md"
    },
    {
      "title": "Coinbase: Introducing Agentic Wallets (February 11, 2026)",
      "url": "https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets"
    },
    {
      "title": "CoinDesk: AI agents gave themselves permission to spend more crypto in a new test (November 1, 2026)",
      "url": "https://www.coindesk.com/tech/2026/11/01/ai-agents-bypassed-crypto-spending-limits-without-human-approval-researchers-find-in-a-new-test"
    }
  ],
  "related": [
    {
      "title": "Can an AI agent raise its own spending limit, and how do you stop it?",
      "url": "https://www.rightshold.com/answers/can-an-ai-agent-raise-its-own-spending-limit-and-how-do-you-stop-it"
    },
    {
      "title": "How to set per-request and per-run spend caps for x402 agent payments",
      "url": "https://www.rightshold.com/answers/how-to-set-per-request-and-per-run-spend-caps-for-x402-agent-payments"
    },
    {
      "title": "How to cap what an AI agent spends on pay-per-token APIs with MPP sessions",
      "url": "https://www.rightshold.com/answers/how-to-cap-what-an-ai-agent-spends-on-pay-per-token-apis-with-mpp-sessions"
    },
    {
      "title": "How to stop a prompt injection from making your AI agent buy something",
      "url": "https://www.rightshold.com/answers/how-to-stop-a-prompt-injection-from-making-your-ai-agent-buy-something"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-11"
}