Your keys, your custody.
Openusdc is self-custodial by design. Agent keys never leave the agent's environment. We can't access your funds because we never see your private keys.
Self-custody means self-custody.
Keys never leave your environment
The agent wallet runs entirely in your infrastructure. Private keys are generated locally, stored locally, and used locally. Openusdc sees signed payment headers — never the keys that signed them.
Open-source and auditable
The SDKs are open-source on GitHub. Every release is reproducibly built. You can read the code and audit the code.
Built on x402
The x402 payment standard is an open protocol maintained by Coinbase and a community of contributors. No proprietary wire format, no vendor lock-in.
Policy-bound wallets
Agent wallets support spend caps, allow-lists, and time-bound keys. You define the policy; the wallet enforces it.
How to keep your agents secure.
- Store keys in environment variablesNever hardcode private keys. Use environment variables or a secrets manager.
- Rotate keys periodicallyUse time-bound keys and rotate them on a schedule that matches your risk tolerance.
- Use scoped permissionsSet spend caps and allow-lists on agent wallets. Grant only the permissions the agent needs.
- Monitor transactionsLog all settlements and set up alerts for unusual activity. Every payment includes a signed receipt.
Found a vulnerability?
If you've found a security issue, please email support@openusdc.ai. We take all reports seriously and will respond as quickly as possible.