Agent setup
Let an agent prepare Hilt Pay API without handing it live control.
Hilt Pay API is built for software that can set up paid access, run sandbox checks, and surface the exact production blockers. Owners still approve the sensitive parts: billing, live API keys, payout wallets, and emergency disable.
POST /v1/access/agent-bootstrap
{
"requested_use_case": "Protect /ai/pro",
"payment_protocol": "x402",
"settlement_rail_id": "solana_usdc",
"requested_live_scopes": [
"access:read",
"access:write",
"access:webhooks"
]
}The response is not a blank dashboard task. It is an actionable setup object with readiness, blockers, next API calls, and the owner approval boundary.
Setup flow
The agent does the implementation work. Hilt keeps the approval model sane.
01
Create setup intent
The agent starts in sandbox mode with a setup intent tied to the owner, requested use case, callback URL, and allowed live scope.
02
Submit manifest
It declares the app, product, protected resource, webhook destination, payment protocol, and launch settlement rail.
03
Resolve blockers
Hilt returns exact readiness blockers: missing owner approval, missing plan, missing payout wallet, webhook not verified, or rail not enabled.
04
Owner approves live controls
The owner approves billing, live keys, payout wallet settings, and emergency disable controls before production traffic runs.
05
Run paid access
The product can return HTTP 402 requirements, create payment sessions, check entitlements, receive webhooks, and keep audit history.
Live boundary
Agent-first does not mean ownerless.
The best agent setup path is powerful because it is constrained. Hilt lets software prepare the integration, but live commercial controls stay owner-approved and auditable.
Guardrails
No seed phrases, private keys, or unrestricted owner credentials.
No live billing or payout wallet changes from a sandbox setup intent.
No production API key until the owner approves the setup.
Use x402 payment requirements with the configured launch settlement path.
No access grant from unsigned webhooks; entitlement checks remain the source of truth.
Protected-resource proof
Build the denied, 402, payment, proof, entitlement, retry loop.
The fastest proof point is still simple: protect one API endpoint, return a Hilt-created x402 requirement when unpaid, settle over Solana USDC, record proof, activate access, then retry.