Frequently Asked Questions

SPEND.md is an open standard for giving AI agents financial autonomy. It's a configuration file format (similar to README.md or LICENSE.md) that defines how an AI agent can spend and earn money.

When combined with the SPEND.md CLI and API, it provisions virtual cards with built-in spending controls, enabling your agents to make purchases autonomously within the rules you define.

As AI agents become more capable, they need to interact with the real world—purchasing API credits, booking services, paying for cloud resources. Currently, this requires manual intervention or giving agents access to personal payment methods.

SPEND.md provides a safer alternative: dedicated wallets with strict spending controls, full audit trails, and human approval workflows when needed.

The SPEND.md file format specification is open and freely available. Anyone can implement parsers or tooling around the format.

The CLI and API service are commercial products that implement the specification and connect to payment infrastructure.

SPEND.md is framework-agnostic. It works with any AI agent framework including:

• LangChain / LangGraph
• AutoGPT
• CrewAI
• Custom agent implementations
• Claude (via MCP tools)

If your agent can read files or make API calls, it can use SPEND.md.

SPEND.md issues virtual Visa debit cards. These are real cards that work anywhere Visa is accepted online. Each card has a unique number, expiration date, and CVV. Physical cards are not currently available.

Yes! You can create multiple cards for a single agent, each with different limits or purposes. For example:

• A "primary" card for general use
• An "api" card specifically for API services
• A "backup" card that's normally frozen

Freeze a card instantly via CLI:

Or via the API. Frozen cards decline all transactions immediately. You can unfreeze them just as quickly when the issue is resolved.

Cards are funded in USD by default. Transactions in other currencies are automatically converted at competitive exchange rates. We support merchants worldwide.

Spending limits are enforced at the payment processor level, not in your agent's code. This means:

• Limits can't be bypassed by a compromised agent
• Transactions exceeding limits are declined in real-time
• No money leaves your account until rules are satisfied

When a transaction would exceed a limit:

1. The transaction is declined
2. A transaction.declined event is emitted
3. You receive a notification (if configured)
4. The agent receives an error response

Limits reset automatically—daily limits at midnight UTC, monthly limits on the first of each month.

Yes! Update your SPEND.md file and run:

Changes take effect immediately. This is why version-controlling your SPEND.md is valuable—you can track and review all limit changes.

Allowlists and blocklists control which merchants your agent can transact with:

• Allowlist: If defined, ONLY these merchants are permitted
• Blocklist: These merchants are always blocked
• Categories: Broad controls by merchant type (api_services, cloud_hosting, etc.)

Allowlist takes precedence. If you set an allowlist, only those merchants are allowed regardless of category settings.

Yes! If you enable the earning section in SPEND.md, your agent can:

• Charge per API request or per token
• Offer subscriptions
• Accept tips

Earnings are deposited into the agent's wallet and can be used for spending or withdrawn to your bank account.

When your agent's balance exceeds the withdraw_threshold, funds are automatically transferred to your connected bank account via Stripe Connect.

You can also trigger manual withdrawals via CLI or API.

SPEND.md charges 2.9% + $0.30 per transaction for earning (standard Stripe pricing). There are no additional platform fees for the earning functionality.

SPEND.md is designed with compromised agents in mind. Multiple layers protect you:

• Hard spending limits cap potential damage
• Merchant allowlists prevent unauthorized merchants
• Approval workflows require human confirmation for large amounts
• Real-time alerts enable fast response
• Instant card freeze via CLI or API

Even a fully compromised agent can only spend within the rules you've defined.

Card details are stored securely:

• Full card numbers are encrypted at rest with AES-256
• CVVs are only shown once at creation, then stored encrypted
• Local card details (from spend card create) are stored encrypted in ~/.spend/
• SPEND.md files can optionally include encrypted card references

Yes. SPEND.md is PCI DSS Level 1 compliant, the highest level of certification. We never store raw card numbers in your SPEND.md files or logs. All card data is handled by our PCI-compliant payment infrastructure.

SPEND.md has three tiers:

• Free: 1 card, $500/mo limit, basic controls
• Pro ($19/mo): 5 cards, $10k/mo limit, API access, webhooks
• Team ($99/mo): Unlimited cards, $100k/mo limit, priority support

No transaction fees for spending. You only pay your subscription fee. For earning, standard Stripe fees apply (2.9% + $0.30).

Fund your wallet via:

• Bank transfer (ACH in US, SEPA in EU)
• Credit/debit card (3% fee)
• Agent earnings (if earning is enabled)

Minimally. Your agent needs to:

1. Read card details from SPEND.md or the API
2. Use those details when making purchases
3. Optionally handle declined transaction errors

If your agent already uses payment methods, it's mostly a matter of swapping in the SPEND.md card details.

Yes! The CLI is designed for automation:

# In your CI pipeline
SPEND_API_KEY=${{ secrets.SPEND_API_KEY }}
spend validate
spend apply --yes

Use environment variables for API keys and the --yes flag to skip prompts.

Rate limits depend on your plan:

• Free: 60 requests/minute, 1,000/day
• Pro: 300 requests/minute, 50,000/day
• Team: 1,000 requests/minute, unlimited/day

Yes! Use test API keys (prefix sk_test_) to:

• Create test wallets and cards
• Simulate transactions without real money
• Test your integration before going live

Test mode mirrors production behavior but never charges real money.