Machine payments

AI Accounting is agent-native, and so is its billing. An LLM agent can sign up and pay for the platform on its own — without a human filling in a checkout form. This builds on Stripe's Machine Payments Protocol (MPP): an agent that hits the paywall receives a 402 Payment Required with a machine-readable challenge describing exactly how to pay.

Two ways an agent gets an account

Human creates, agent pays. A human signs up the normal way (magic link), generates an API key in the dashboard, and hands it to the agent. The agent uses the key and, when the trial ends, answers the payment challenge.

Fully autonomous. The agent provisions its own org and credentials through POST /api/signup, then pays. This endpoint is disabled by default on each deployment (AUTONOMOUS_SIGNUP_ENABLED) because it creates accounts with no human in the loop; operators opt in explicitly.

Autonomous signup

curl -X POST "$FLYWHEEL_HOST/api/signup" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{ "name": "Acme Bot Co", "currency": "USD" }'

The response returns your organization id and an API key once — store it securely, it is never shown again:

{
"data": {
  "organization_id": "…",
  "api_key": "ak_…",
  "scopes": ["read", "write", "reports"],
  "subscription_status": "trialing",
  "trial_ends_at": "…"
},
"error": null
}

Notes:

• An Idempotency-Key header is required. A retried request with the same key does not create a second org — it returns 409 Conflict.
• The key is minted with least-privilege scopes (read, write, reports) — not full. The org owner can mint a broader key later.
• New orgs start a 14-day trial.

Checking billing state

GET /subscription reports where the org stands — and is reachable even while the org is behind the paywall, so a blocked agent can always find out how to fix it:

curl "$FLYWHEEL_API/subscription" \
-H "Authorization: Bearer $FLYWHEEL_KEY"

The MCP surface exposes the same data via the get_subscription tool.

The payment challenge (402)

When machine payments are enabled and an org's trial has expired (or its subscription lapsed), the REST API and MCP return 402 with an MPP-style challenge. On REST it arrives as a WWW-Authenticate: Payment … header plus a machine-readable body; on MCP it arrives in the JSON-RPC error data.

HTTP/1.1 402 Payment Required
WWW-Authenticate: Payment method="stripe", intent="subscribe", pay_url="https://…/api/v1/subscription/pay", network_id="profile_…"

The agent reads the challenge, settles the subscription, and retries.