Agent payments (MPP)

Agent payments quickstart

Pay for one Tomba request with the InFlow CLI, then see what the payment exchange looks like on the wire. Prices and billing rules are on Tomba for AI agents.

Before you begin

You need an InFlow account in the production environment with a USDC or USDT balance. You don't need a Tomba account or API key.

Pay for a request with the InFlow CLI

Install the InFlow CLI. On macOS and Linux:
```
Code
curl -fsSL https://inflowcli.ai/install.sh | bash
```
On Windows, in PowerShell:
```
Code
irm https://inflowcli.ai/install.ps1 | iex
```
Both commands download and run an installer script. To read the script before you run it, open the URL in a browser.
Sign in to InFlow. The client name appears on the approval page that opens in your browser.
```
Code
inflow auth login --client-name "my-agent"
```
Pay for a request:
```
Code
inflow mpp pay "https://agents.tomba.io/domain-search?domain=stripe.com" --interval 5 --max-attempts 180
```
The CLI reads the 402 challenge, creates the payment, waits until InFlow reports it ready, sends the request again with the credential, and prints the result. Tomba's response is in body, and outcome is paid when the payment settled. If InFlow asks you to approve the payment, approve it while the command waits.

Without --interval, the command returns after creating the payment, with a transaction_id and the inflow mpp fetch command that completes the request.

Other endpoints work the same way. Use the query parameters of the matching Tomba API endpoint:

Code
inflow mpp pay "https://agents.tomba.io/email-finder?domain=stripe.com&first_name=Jane&last_name=Doe" --interval 5 --max-attempts 180
inflow mpp pay "https://agents.tomba.io/email-verifier?email=jane.doe@stripe.com" --interval 5 --max-attempts 180
inflow mpp pay "https://agents.tomba.io/technology?domain=stripe.com" --interval 5 --max-attempts 180

Approve payments automatically

By default InFlow holds every MPP charge for manual approval. The payment sits in Approvals as Pending approval until you click the green tick, which is why the commands above pass --interval 5 --max-attempts 180 — the CLI is polling for up to fifteen minutes while it waits for you. An unattended agent just stalls.

A policy removes the wait. Create one at app.inflowpay.ai/policies/add:

Field	Value
Policy Type	`MPP`
Policy Action	`Approve Requests`
Currency	The currency you pay in — `USDC` or `USDT`
Budget	Total the policy may approve in one period, for example `10`
Threshold	Optional cap on a single payment. Must not exceed the budget
Period	`Once`, `Daily`, `Monthly` or `Yearly`
Reserved	Sets the budget aside from your available balance. `Once` periods only
Seller	`All Sellers`, or `A Specific Seller` to limit the policy to Tomba
Expires	Optional. The policy stops matching new requests after this time

Tomba's seller id, if you scope the policy to this service alone:

Code
4e0db086-a9c2-4291-a278-acb98f994572

Once it is active, charges are approved as they arrive and inflow mpp pay returns without polling.

A policy matches on currency. One written for USDT does not approve a USDC challenge, and the payment waits for manual approval again — see Choose a currency.

A Once period never resets, so the policy stops approving when its budget is spent and payments silently queue again. Check Spent against Budget on the policy if an agent starts waiting. Use Daily or Monthly for a standing allowance.

Create the policy from the API

The dashboard form maps onto POST /v1/policies. Only type and action are required:

Code
curl -X POST https://api.inflowpay.ai/v1/policies \
  -H "X-API-Key: $INFLOW_PRIVATE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "MPP",
    "action": "APPROVE",
    "currency": "USDT",
    "budget": 10,
    "threshold": 0.05,
    "period": "MONTHLY",
    "sellerId": "4e0db086-a9c2-4291-a278-acb98f994572"
  }'

It answers 200 with the created policy:


Code
{
    "policyId": "9aaaf91e-0ae4-4b01-8970-aa29e0d2e6ad",
    "type": "MPP",
    "action": "APPROVE",
    "status": "ACTIVE",
    "currency": "USDT",
    "budget": "0.01",
    "threshold": "0.005",
    "period": "ONCE",
    "requesterId": "4e0db086-a9c2-4291-a278-acb98f994572",
    "created": "2026-10-06T10:54:01.903Z",
    "updated": "2026-10-06T10:54:01.903Z"
}

action is one of APPROVE, DECLINE or REVIEW; period one of ONCE, DAILY, MONTHLY or YEARLY; currency one of USDC, USDT or PYUSD. Omit sellerId to apply the policy to every seller.

budget, threshold, currency and period only take effect when action is APPROVE. Send them with REVIEW or DECLINE and they are dropped without an error — the request still returns 200, and the policy it creates has no spending limit at all. Read the policy back after creating it and check the fields you sent are present.

The seller you send as sellerId is returned as requesterId. A policy with no requesterId applies to every seller.

List what you have with GET /v1/policies, read one with GET /v1/policies/{policyId}, and remove one with DELETE /v1/policies/{policyId}/delete.

Choose a currency

Every endpoint offers one challenge in USDC and one in USDT. Check what the endpoint offers and what your account can pay with:

Code
inflow mpp inspect "https://agents.tomba.io/domain-search?domain=stripe.com"
inflow mpp supported
inflow balances list

Then pay in the currency you hold:

Code
inflow mpp pay "https://agents.tomba.io/domain-search?domain=stripe.com" --currency USDT --interval 5 --max-attempts 180

Without --currency, the CLI doesn't check which currency your balance holds. If it takes the challenge in the other currency, the payment fails for lack of funds.

What the exchange looks like

Call an endpoint without a credential to see the challenges:

Code
curl -i "https://agents.tomba.io/domain-search?domain=stripe.com"

The response has status 402 and one WWW-Authenticate header that lists a Payment challenge per currency, separated by commas (values shortened here):

Code
HTTP/2 402
content-type: application/problem+json
cache-control: no-store
www-authenticate: Payment id="uVqFx76…", realm="agents.tomba.io", method="inflow", intent="charge", request="eyJhbW91bnQiOiIwLjAwMzEyIiwiY3VycmVuY3kiOiJVU0RDIiwi…", expires="2026-09-29T17:08:48.175Z", opaque="eyJfbXBweF9zY29wZSI6…", Payment id="jK_Djgg…", realm="agents.tomba.io", method="inflow", intent="charge", request="eyJhbW91bnQiOiIwLjAwMzEyIiwiY3VycmVuY3kiOiJVU0RUIiwi…", expires="2026-09-29T17:08:48.569Z", opaque="eyJfbXBweF9zY29wZSI6…"

request is base64url-encoded JSON with the terms, for example {"amount":"0.00312","currency":"USDC","methodDetails":{"rail":"balance"},"recipient":"…"}.
opaque binds the challenge to the endpoint you called.
expires is the time after which the challenge, and any credential issued for it, is no longer accepted.

The body repeats the price and the CLI commands, and adds agent_instructions and agent_memory fields written for LLM agents:


Code
{
    "error": {
        "code": "payment_required",
        "message": "Payment required. Use the InFlow CLI to pay and retry."
    },
    "payment": {
        "amount": "0.00312",
        "currency": "USDC",
        "accepted_currencies": ["USDC", "USDT"],
        "display": "$3.12 per 1,000 requests",
        "supported_rails": ["mpp"]
    },
    "how_to_pay": {
        "inflow": "inflow mpp pay https://agents.tomba.io/domain-search?domain=stripe.com",
        "inspect": "inflow mpp inspect https://agents.tomba.io/domain-search?domain=stripe.com"
    }
}

A paid response has Tomba's status and body, plus these headers:

Header	Value
`Payment-Receipt`	Proof of payment, as base64url-encoded JSON. Only on charged responses.
`X-Payment-Charged`	`true` if the request was charged, `false` if it wasn't. See Billing.
Rate limit headers	Forwarded from the Tomba API; see Rate limits.
`X-Request-ID`	Correlation id for this response. Quote it in a support request. Echoes an inbound one.

Pay without the CLI

To pay from your own code, make the same calls the CLI makes. Authenticate to InFlow with your account's API key in the X-API-KEY header.

Send the request and read the WWW-Authenticate header of the 402 response. Split it into its Payment challenges, and choose the one whose decoded request has the currency you hold.

Create a transaction for that challenge. Send the challenge's parameters as a JSON object, with every value unchanged:

Code
curl -X POST "https://api.inflowpay.ai/v1/transactions/mpp" \
  -H "X-API-KEY: $INFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge": {
      "id": "<id>",
      "realm": "agents.tomba.io",
      "method": "inflow",
      "intent": "charge",
      "request": "<request>",
      "expires": "<expires>",
      "opaque": "<opaque>"
    },
    "options": {}
  }'

The response has a state. While it's pending, wait retryAfterSeconds seconds and poll the transaction until the state is ready. A failed or expired state ends the attempt.
```
Code
curl "https://api.inflowpay.ai/v1/transactions/<transactionId>/mpp" \
  -H "X-API-KEY: $INFLOW_API_KEY"
```

Send the original request again with the credential from the ready transaction:

Code
curl -i "https://agents.tomba.io/domain-search?domain=stripe.com" \
  -H "Authorization: Payment <credential>"

Use with AI agents has this flow as a Python helper, and a JavaScript version built on InFlow's buyer SDK.

Last modified on October 6, 2026

Overview Use with AI agents