2026.08.05Cloudflare Wallets and cloudflare.pay: Identity and Payments for AI Agents18 min read Cloudflare Wallets delegation tree Four layers of authority. A human account owner funds an Account Wallet holding the stablecoin balance. The Account Wallet delegates capped authority to three Virtual Wallets, each carrying its own weekly budget, per-call ceiling and merchant allowlist. Each Virtual Wallet issues an API key to one agent, which spends without per-transaction human approval. No agent can exceed the limits set above it. Delegated spending authority who is allowed to spend what funds · sets the ceiling delegates capped authority API key Human account owner a Cloudflare account, not a keypair Account Wallet stablecoin balance · on-ramp / off-ramp Virtual Wallet Virtual Wallet Virtual Wallet research agent ETL agent reader agent inference · $100 / wk max $2 per call data feeds · $20 / wk allowlist: 4 hosts web content · $5 / wk allowlist: 12 hosts research.acme etl.acme reader.acme no human approval per call · every child is bounded by its parent handles resolve under <name>.cloudflare.pay
