Staying in control
How to revoke an AI agent's payment access
Pause, rotate or revoke the agent's credential, and separately revoke any on-chain allowance. What each step stops and what it leaves in place.
Revoke or rotate the credential the agent uses so its next call is refused, and separately revoke any on-chain token allowance you granted for unattended payments. Then check for payments that were already waiting for approval.
Why is this harder than it sounds?
Agent payment access usually has more than one layer, and removing one doesn't remove the others. The agent's credential lets it make requests. An on-chain allowance lets a spender move tokens from your wallet whether or not anyone is still making requests, and it lives on the blockchain, so only a transaction from your wallet changes it. And payments created before you acted may still be waiting for someone to approve them.
How do you do it?
- Pause if you might resume. Pausing an endpoint refuses calls without destroying anything, which is right when you're investigating.
- Rotate if the credential leaked. Rotating issues a new credential and kills the old one. Update the hosts you trust with the new one.
- Revoke to end it. Revoking the endpoint means the credential no longer works anywhere.
- Set the allowance to zero. Under ERC-20, approve(spender, 0) replaces the allowance with zero. Your wallet signs and pays the gas.
- Clear pending approvals. Reject or let lapse anything still awaiting approval, and don't open old approval links.
- Check the log. Confirm the revocation and allowance change appear, and look for anything that happened just before.
What it does not mean
- Removing the server from your MCP client is not revocation. The credential still works anywhere else it was copied.
- Revoking a credential doesn't touch an on-chain allowance. Those are separate.
- Deleting the agent's chat history doesn't undo anything it was authorised to do.
Common questions
Can the agent revoke itself?
No tool lets the agent change its own access in Veyra; that's an owner action in the dashboard.
Do I need to revoke the allowance if I revoke the endpoint?
If you're done with auto-pay, yes. The allowance is on-chain and separate from the credential.
Where does Veyra fit?
Each Veyra endpoint page has pause, resume, rotate, revoke and delete. A revoked credential gets a 401 on every call. Auto-pay allowances are revoked separately: Veyra builds a zero-allowance approve transaction for your own wallet to sign and submit (Veyra never submits it for you), and records source.allowance_revoked in the audit log. Payments awaiting approval lapse after 24 hours if nobody acts, and rejecting in your wallet cancels one immediately.
Sources
Terms on this page
This page explains how agent payments and the related technology work. It is not financial, investment, legal or tax advice. Protocols and provider features change; check the linked official sources before relying on a detail.