Agentic Wallets

Agentic wallets give AI agents the ability to hold funds, sign transactions, and interact with smart contracts autonomously - without exposing private keys to the agent or the LLM. This page covers the two leading solutions that work on Paxeer today: Coinbase AgentKit and Privy server wallets.

How It Works

An agentic wallet sits between your AI agent and the blockchain:

1. Agent decides - The LLM reasons about what onchain action to take (e.g. "send 5 USDC to 0x...").
2. SDK prepares - The wallet SDK constructs and validates the transaction.
3. Policy check - The policy engine evaluates the transaction against spending limits, allowlists, and other guardrails.
4. TEE signs - The private key, isolated in a Trusted Execution Environment, signs the transaction. The key is never exposed to the agent.
5. Broadcast - The signed transaction is submitted to Paxeer's EVM RPC.

┌─────────┐     ┌───────────┐     ┌──────────────┐     ┌─────────┐     ┌──────────┐
│ LLM /   │────▶│ Wallet    │────▶│ Policy       │────▶│ TEE     │────▶│ Paxeer EVM  │
│ Agent   │     │ SDK       │     │ Engine       │     │ Signer  │     │ RPC      │
└─────────┘     └───────────┘     └──────────────┘     └─────────┘     └──────────┘

Quick Comparison

Use both together: AgentKit ships with a built-in PrivyWalletProvider, so you can combine Privy's policy engine with AgentKit's 40+ action providers.

Coinbase AgentKit on Paxeer

AgentKit is Coinbase's open-source toolkit for giving AI agents crypto wallets and onchain capabilities. It is framework-agnostic (LangChain, Vercel AI SDK, OpenAI Agents SDK, MCP) and wallet-agnostic (CDP wallets, Privy, Viem, and more).

Architecture

AgentKit is organized around three concepts:

• Wallet Providers - Abstraction over different wallet implementations. For Paxeer, use ViemWalletProvider (TypeScript) or EthAccountWalletProvider (Python).
• Action Providers - Units of onchain functionality (ERC-20 transfers, ERC-721 ops, Pyth price feeds, etc.). Generic EVM providers work on Paxeer; providers with hard-coded chain allowlists (e.g. x402ActionProvider, wethActionProvider, CDP-managed ones) do not - see the support matrix below.
• Framework Extensions - Adapters that turn AgentKit actions into tools for your AI framework of choice.

Prerequisites

• Node.js v22+ (TypeScript) or Python 3.10+
• A CDP Secret API Key (for CDP wallet providers; not required for Viem)
• A funded wallet on Paxeer

Setup

npm install @coinbase/agentkit @coinbase/agentkit-langchain viem

import { AgentKit, ViemWalletProvider, walletActionProvider, erc20ActionProvider } from '@coinbase/agentkit';
import { createWalletClient, http } from 'viem';
import { privateKeyToAccount } from 'viem/accounts';
import { sei } from 'viem/chains';

// Create a Viem wallet client pointed at Paxeer
const account = privateKeyToAccount(process.env.PRIVATE_KEY as `0x${string}`);
const client = createWalletClient({
  account,
  chain: sei,
  transport: http('https://evm-rpc.sei-apis.com'),
});

// Wrap it in AgentKit
const walletProvider = new ViemWalletProvider(client);
const agentKit = await AgentKit.from({
  walletProvider,
  actionProviders: [
    walletActionProvider(),
    erc20ActionProvider(),
    // Add more action providers as needed
  ],
});

import { getLangChainTools } from '@coinbase/agentkit-langchain';
import { ChatOpenAI } from '@langchain/openai';
import { createReactAgent } from '@langchain/langgraph/prebuilt';

const tools = await getLangChainTools(agentKit);
const model = new ChatOpenAI({ model: 'gpt-4o' });

const agent = createReactAgent({
  llm: model,
  tools,
  messageModifier:
    'You are an AI agent operating on the Paxeer blockchain. You can check balances, transfer tokens, and interact with smart contracts.',
});

// Run the agent
const result = await agent.invoke({
  messages: [{ role: 'user', content: 'What is my HPX balance?' }],
});

Available Action Providers on Paxeer

Not every AgentKit action provider works on Paxeer - some are chain-specific. Here's what you can use:

Known Quirks on Paxeer

Verified by running AgentKit against Paxeer (chain 125). These quirks sit in AgentKit's network and action-provider layer and apply to both ViemWalletProvider and PrivyWalletProvider:

• Balances are labeled "ETH" in action output. walletActionProvider hard-codes the native-currency symbol, so get_wallet_details returns strings like Native Balance: 512993.50 ETH and native_transfer responses say Transferred 0.05 ETH to 0x... even on Paxeer. Signing and arithmetic are unaffected - it's a display-only quirk. If the LLM will quote balances or transfer confirmations to users, add a post-processing step or a system-prompt instruction to rewrite ETH → HPX when chain_id == 125.
• networkId is undefined. Coinbase's internal CHAIN_ID_TO_NETWORK_ID map only includes Ethereum, Polygon, Base, Arbitrum, and Optimism (mainnet + testnet). Paxeer's chain ID isn't in it, so walletProvider.getNetwork() returns { protocolFamily: 'evm', chainId: '125', networkId: undefined }. This is harmless for signing/sending, but any action provider that branches on networkId will refuse to run on Paxeer. In practice, AgentKit.from({...}) prints a warning like The following action providers are not supported on the current network and will be unavailable: weth, x402 and silently drops them - if you expect an action and it's missing from agentKit.getActions(), check this warning first.

CDP-Managed Wallets and Paxeer

AgentKit's CdpEvmWalletProvider (CDP-managed server wallets with built-in policies) is currently scoped to base, base-sepolia, ethereum, ethereum-sepolia, polygon, arbitrum, and optimism - Paxeer is not a supported network.

For managed cloud custody with a policy engine on Paxeer, use one of:

• Privy server wallets (below) - TEE-isolated keys with a policy engine that works on any EVM chain, including Paxeer.
• AgentKit + Privy combined - use PrivyWalletProvider inside AgentKit to keep the 40+ action providers while delegating custody and policy enforcement to Privy. See Using AgentKit with Privy (Combined) below.

If you only need self-custodial keys (no TEE, you hold the private key), use ViemWalletProvider as shown above and enforce limits in your own application logic.

Privy Server Wallets on Paxeer

Privy provides wallet-as-a-service infrastructure for AI agents. Server wallets are programmatically managed wallets designed for backend use - no user interaction required. Keys are isolated in TEEs with Shamir secret sharing and never leave secure enclaves.

Prerequisites

• A Privy account with an App ID and App Secret
• An authorization keypair (generated in the Privy dashboard)

Setup

curl --request POST https://api.privy.io/v1/wallets \
  -u "<your-app-id>:<your-app-secret>" \
  -H "privy-app-id: <your-app-id>" \
  -H 'Content-Type: application/json' \
  -d '{
    "chain_type": "ethereum",
    "policy_ids": ["your_policy_id"]
  }'

{
  "id": "wallet_abc123",
  "address": "0x1234...abcd",
  "chain_type": "ethereum",
  "policy_ids": ["your_policy_id"]
}

curl --request POST https://api.privy.io/v1/wallets/wallet_abc123/evm/reference \
  -u "<your-app-id>:<your-app-secret>" \
  -H "privy-app-id: <your-app-id>" \
  -H "privy-authorization-signature: <authorization-signature>" \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "eth_sendTransaction",
    "caip2": "eip155:125",
    "params": {
      "transaction": {
        "to": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
        "value": "0x2386F26FC10000",
        "chain_id": 125
      }
    }
  }'

curl --request POST https://api.privy.io/v1/wallets/wallet_abc123/evm/reference \
  -u "<your-app-id>:<your-app-secret>" \
  -H "privy-app-id: <your-app-id>" \
  -H "privy-authorization-signature: <authorization-signature>" \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "personal_sign",
    "caip2": "eip155:125",
    "params": {
      "message": "Hello from Paxeer"
    }
  }'

Known Quirks on Paxeer (Privy)

Verified by running @privy-io/server-auth against Paxeer (eip155:125):

• value must be a hex string, not a BigInt. Privy's request signer uses RFC 8785 JSON canonicalization (canonicalize), which throws TypeError: Do not know how to serialize a BigInt if you pass a BigInt in any field of the transaction object. Convert viem's parseEther(...) output with '0x' + parseEther('0.01').toString(16) before sending.
• authorizationKeyIds on createWallet expects the public-key registration ID, not the dashboard key ID. Passing the ID shown next to a key in the Privy dashboard can fail with 400 Invalid authorization key IDs. If you only need an app-owned wallet (app credentials + authorizationPrivateKey for request signing), omit authorizationKeyIds - the wallet is still fully operable.

Privy with LangChain

Privy publishes a LangChain integration (langchain-privy) that exposes wallet operations as a single LangChain tool. The tool reads PRIVY_APP_ID and PRIVY_APP_SECRET from the environment and is bound directly to the LLM:

import os
from langchain_privy import PrivyWalletTool
from langchain_openai import ChatOpenAI

os.environ["PRIVY_APP_ID"] = "<your-app-id>"
os.environ["PRIVY_APP_SECRET"] = "<your-app-secret>"

tool = PrivyWalletTool()
print(f"Wallet: {tool.wallet_address}")

llm = ChatOpenAI(model="gpt-4o-mini", temperature=0)
llm_with_tools = llm.bind_tools([tool])

response = llm_with_tools.invoke("What is my wallet address?")

Privy Policy Engine

Privy's policy engine evaluates policies server-side before signing. Each rule pairs an ALLOW/DENY action with an RPC method and a list of conditions on transaction fields. Attach one or more policies to a wallet via updateWallet.

// "Cap sends at 10 HPX and block a specific address."
// Rule 1 (ALLOW) defines the happy path; without it, every request is denied.
// Rule 2 (DENY) carves a specific hole in that allow.
const policy = await privy.walletApi.createPolicy({
  name: 'paxeer-agent-policy',
  version: '1.0',
  chainType: 'ethereum',
  rules: [
    {
      name: 'Allow sends up to 10 HPX',
      action: 'ALLOW',
      method: 'eth_sendTransaction',
      conditions: [
        {
          fieldSource: 'ethereum_transaction',
          field: 'value',
          operator: 'lte',
          value: '10000000000000000000', // 10 HPX in wei
        },
      ],
    },
    {
      name: 'Deny sends to blocklisted address',
      action: 'DENY',
      method: 'eth_sendTransaction',
      conditions: [
        {
          fieldSource: 'ethereum_transaction',
          field: 'to',
          operator: 'in',
          value: ['0xdEAD000000000000000042069420694206942069'],
        },
      ],
    },
  ],
});

// Attach policy to wallet
await privy.walletApi.updateWallet({
  id: wallet.id,
  policyIds: [policy.id],
});

Privy also offers features beyond the policy engine:

• Key quorums - require multiple authorization keys to approve high-value transactions
• Webhook notifications - get notified of all wallet activity (works chain-agnostically)

Using AgentKit with Privy (Combined)

AgentKit includes a built-in PrivyWalletProvider, so you can use Privy's wallet infrastructure and policy engine as the backend while using AgentKit's 40+ action providers for onchain operations.

Because of the authorizationKeyIds quirk noted above, the simplest working pattern is to create the wallet once via the Privy SDK (or the dashboard) and then hand the resulting walletId to AgentKit:

import { AgentKit, PrivyWalletProvider, walletActionProvider, erc20ActionProvider } from '@coinbase/agentkit';
import { PrivyClient } from '@privy-io/server-auth';

// Step 1 - create (or look up) a server wallet via the Privy SDK.
// Omit authorizationKeyIds here; attach policies with updateWallet if needed.
const privy = new PrivyClient(process.env.PRIVY_APP_ID!, process.env.PRIVY_APP_SECRET!, {
  walletApi: { authorizationPrivateKey: process.env.PRIVY_AUTH_KEY },
});
const wallet = await privy.walletApi.createWallet({ chainType: 'ethereum' });

// Step 2 - wrap the existing wallet in AgentKit's PrivyWalletProvider.
const walletProvider = await PrivyWalletProvider.configureWithWallet({
  appId: process.env.PRIVY_APP_ID!,
  appSecret: process.env.PRIVY_APP_SECRET!,
  chainId: '125', // Paxeer mainnet
  walletId: wallet.id,
  authorizationPrivateKey: process.env.PRIVY_AUTH_KEY,
});

const agentKit = await AgentKit.from({
  walletProvider,
  actionProviders: [
    walletActionProvider(),
    erc20ActionProvider(),
  ],
});

This gives you the best of both worlds: Privy's fine-grained policies and key quorums with AgentKit's rich action library.

Feature Matrix

Wallet Creation & Key Management

Policy Engine & Guardrails

Gas & Transaction Management

Agentic DeFi Actions

x402 & Machine-to-Machine Payments

Developer Experience

Other Agentic Wallet Solutions

While Coinbase AgentKit and Privy are the most mature options for Paxeer, several other platforms support agentic wallet use cases:

Paxeer Network Configuration Reference

Use these values when configuring any agentic wallet provider for Paxeer: