Cloud payments on Meta Muse (coming, devnet only)

This guide is for an owner whose agent runs on Meta Muse and should pay for jobs with an injected share. It is coming: devnet only, and not switched on.

Status: built for ADR-015 Amendment 3 docs/decisions/ADR-015-amendment-3-cloud-agent-payments.md, not deployed. The world node has threshold payments switched off. Nothing here has been tried on Muse yet: every Muse screen and setting below is to confirm.

Why Muse fits Mode I, if one condition holds

Muse runs each agent on a cloud Linux computer. The model can read any file there, so a key file on that computer is readable by the model. That rules out the on-device signer and the co-signer (Mode C) on Muse itself.

Meta describes a credential store and an egress proxy that add secrets to outgoing requests, so the model sees only a placeholder (to confirm). That is what Mode I (injected share) needs: the agent share stays in the store, and the platform adds it to pay calls only.

The gating condition. Use Mode I on Muse only if Muse can inject the agent share:

• only into requests to your node’s pay endpoint host, <direct address>/v1/pay-mcp;
• only in the AgentLink-Pay-Share header;
• never into another host, another path, a query or a request body.

If Muse cannot limit the secret to that one host and header, do not use Mode I. Your agent then stays on owner-paid jobs: you approve and pay each job yourself. Whether Muse scopes secrets per host, per path and per header is to confirm. Meta also says prompt injection can still misuse tool credentials. The node’s checks and your on-chain limit still apply to every payment, but check what Muse promises before you rely on it.

What you need

• Cloud payments switched on for your node, and the ceremony done up to the agent share (Set up cloud payments, steps 1 to 4, with “injected share” chosen).
• The node’s direct-TLS address. On the world node that will be the .ts.net name on port 8443 (https://<host>.ts.net:8443, to confirm at deploy), never world.stelloz.com.
• A Pay credential for this agent: on the agent’s page, under Credentials, choose the Pay preset. It is shown once. It is not the credential of the agent’s main /mcp.

1. Store the agent share and the Pay credential

In Muse’s credential store (exact screen to confirm), add two secrets:

Secret	Value	Bound to
Pay share	the alsh_... string the ceremony showed once	host: your node’s direct address; header: AgentLink-Pay-Share
Pay credential	the alc_... Pay credential	host: your node’s direct address; header: Authorization, as Bearer <secret>

• Paste the share straight from the ceremony into the store. Never paste it into the Muse chat, a file on the Muse computer, a note or a prompt.
• Bind both to the direct address only. If the store lets you, bind them to the path /v1/pay-mcp too.
• If the store cannot bind a secret to one host and header, stop here (gating condition above).

2. Add the pay endpoint as an MCP server

Add a second MCP server for the agent (exact screen to confirm):

• URL: https://<direct address>/v1/pay-mcp, as the ceremony page shows it under “Copy the pay endpoint”.
• Transport: Streamable HTTP, the same kind as the agent’s main Stelloz server.
• Headers: Authorization: Bearer <Pay credential placeholder> and AgentLink-Pay-Share: <Pay share placeholder>, filled from the store.

Keep the agent’s main Stelloz MCP server as it is. Its URL is <node URL>/mcp with the agent’s own credential, and it must never carry the share header. The main /mcp ignores the header anyway, but a share sent there has left the one place it belongs.

3. Test it

Ask your agent, in your own chat with it: “Call agentlink_wallet on the Stelloz pay endpoint.” Then press “Check the test signature” on the agent’s page.

• testSignature: "stored" in the agent’s answer, and “Test signature verified” on the page: done. Your agent pays with agentlink_pay { taskUid } on the pay endpoint, within the limits you signed.
• testSignature: "waiting_for_pin": finish step 5 of the ceremony (the spending limit and the wallet pin) first, then ask again.
• 403 with direct_tls_required: the server URL is not the direct address.
• 403 with share_missing, share_invalid or share_mismatch: the share header is absent, mistyped, or from another key. Paste the share again from a new key if you no longer have it.
• 403 with pay_scope_required: the credential is not a Pay credential.

Then send a little fee SOL to the agent key with the link on the page (Set up cloud payments, step 6).

Rotate and stop

• Every 90 days, or at once after a suspected leak: make a new key on the agent’s page, then replace the Pay share secret in Muse with the new one.
• To stop: use “Stop cloud payments” on the agent’s page (your wallet removes the limit, then the node deletes its share). Then delete the Pay share secret from Muse, and revoke the Pay credential under Credentials if nothing else uses it.

What the agent sees and does: Cloud payments for agents.