OceanAltOceanAlt

COMPLIANCE PAYMENT GATEWAY · SELF-SERVE

Put a compliance firewall on your agent

RUN YOUR FIRST CHECK IN A MINUTE

No login, no API key. Paste it into a terminal and you get a real verdict: the call, a risk score, and the on-chain evidence behind each signal.

curl "https://oceanalt.com/api/risk?addr=0x0000000000000000000000000000000000000000"

Once that works, read on. Below is where you set caps and allowlists, and watch a payment actually get blocked.

What this page does

  1. 1Register an agent and give it a (limits / allowlist / purpose).
  2. 2Every payment runs 11 gates before settlement and gets a verdict: over-reach, hijacks, impersonation, replays and sanctioned payees are stopped before the money moves.
  3. 3The integrator acts on the verdict; direct on-chain transfers that bypass the gateway are not covered.

The tabs below (firewall / / / address screening) are facets of the same live gateway.

This gateway has 11 gates

9 on by default · 2 optional (opt-in per tenant)

Every payment runs these gates in order; any block stops it. The demo's “Ran X / 11” is these same gates ruling on one payment.

  1. 1Attribution (KYA)
  2. 2Revocation check
  3. 3Identity proof (anti-impersonation)
  4. 4KYC gate (optional)optional
  5. 5Per-payment limit
  6. 6Daily cumulative limit
  7. 7Payee allowlist
  8. 8Mandate-intent match (anti prompt-injection)
  9. 9AML sanctions & risk screening
  10. 10Behavioral anomaly detection (optional)optional
  11. 11Replay & double-spend prevention

Submit a payment and watch the gates rule before settlement: allow / review / block. Live gateway.

Demo wallet (illustrative)

1,000 USDC

Hit a button below and watch what happens when your AI agent is attacked.

Real calls: with the firewall ON, the block is made live by the /api/pay gateway, not an animation.

Or: call the HTTP gateway directly (zero deps, any language)

Register to get an agentSecret, then attach it + a one-time nonce on each payment; the gateway runs every pre-settlement gate. Pure fetch below, runnable as-is.

const API = "https://oceanalt.com/api/pay";

// 1) Register the agent + its own mandate (returns agentSecret)
const reg = await fetch(API, { method: "POST", headers: { "content-type": "application/json" },
  body: JSON.stringify({ action: "register", agentId: "my-bot", entity: "Acme (KYC)",
    mandate: { maxUsdc: 5, dailyUsdc: 50, payees: ["0x…"], purpose: "buy-data" } }) }).then(r => r.json());

// 2) Pay through the firewall (credential + one-time nonce)
const r = await fetch(API, { method: "POST",
  headers: { "content-type": "application/json", "x-agent-secret": reg.agentSecret },
  body: JSON.stringify({ agentId: "my-bot", amountUsdc: 2, to: "0x…", purpose: "buy-data",
    nonce: crypto.randomUUID() }) }).then(r => r.json());
r.decision === "allow" ? settle() : console.warn("Blocked at", r.pillar, r.reasonEn);

Your credential lives only in your browser. Want to see it hold up under impersonation / hijack? Switch to the “KYA identity” / “Firewall” tabs above.