Inspiration
AI agents can already search, compare and assemble a basket, but consumers will not let them pay unchecked: more than half are uncomfortable with agents buying for them, and only about 1% want fully automated shopping. Disputed agent purchases also lack non-repudiable proof that the user approved that exact transaction, and prompt-based guardrails can be bypassed, so the only reliable defence is an agent that cannot complete payment at all. PayPal’s strongest advantage in the agent-payments race is trust and security, and ClawPay turns that advantage into something users can physically feel. Phone pop-ups and OTP codes exclude older adults and people with visual or motor impairments, so we also wanted a voice-first, single-gesture approval.
What it does
ClawPay lets users shop by voice through Siri or push-to-talk on the Apple Watch, or through the ESP-Claw device. The assistant builds orders through a four-tool MCP server (search_products, create_order, get_order_status, get_spending_summary), none of which can approve or pay. The backend checks every order against the device’s passport and spending limits (100 per order and 500 per day by default), then issues a challenge with a 120-second expiry that binds the exact amount, merchant and cart. The user confirms on the wrist or by holding the device button, and only after the backend verifies the signature does it create and capture the PayPal Sandbox payment. A read-only dashboard shows orders, approvals, payments, audit events, passports and signed receipts.
How we built it
The backend uses Python 3.12, FastAPI and Supabase Postgres with row-level security, with payment invariants enforced in the database. Merchant agents (Grocer, Electronics and a live Channel3 catalogue) and a separate PayPal agent, which holds the credentials, communicate over A2A, while the device agent uses MCP. Devices sign a canonical approval payload with ECDSA P-256 (using the Secure Enclave on the watch), and passports and receipts are signed with Ed25519 over canonical JSON. Payments use PayPal REST orders and vault, verified webhooks and a background reconciler. Voice runs through an OpenAI-compatible LLM proxy with per-device budgets and Fish Audio for speech. The clients are a SwiftUI watchOS app, an ESP32-S3 device and a Vite/React/Hono dashboard on Cloudflare Workers, backed by an offline pytest suite and pgTAP database tests.
Challenges we ran into
The hardest design problem was making sure a compromised agent has no path to move money, which meant treating every merchant quote as untrusted and recomputing totals so the signed payload always matches what the user saw. We also had to prevent double charges and lost reservations during crashes, retries and uncertain PayPal outcomes, and to enforce passport checks atomically so races between quoting and order creation could not slip through. On the hardware side, the stock ESP-Claw image has no payment signing and its key would be software-held. Finally, we could only validate against the PayPal Sandbox, and the watch app was tested in the simulator rather than on a physical device.
Accomplishments that we're proud of
We built the full path from a spoken request to a captured PayPal Sandbox payment, with a complete audit trail. The security guarantee is structural: no tool available to the agent can approve or capture a payment, and the PayPal credentials sit in a separate agent the LLM cannot reach. Agent passports and receipts are signed and independently verifiable with a public key, and the payment invariants are enforced in the database rather than only in application code. The design is open, so other agents, merchants and approver devices can plug in without touching payment logic. We are also proud of the offline test suite and of labelling every feature honestly as built, prototype or roadmap.
What we learned
We learned that trust in agentic commerce depends on separating intent from authority, and that prompt guardrails are not a defence, so safeguards must be architectural and cryptographic. Idempotency, reconciliation and atomic reservations matter as much as the happy path in payments. “Approve what you saw” only holds if the device signs the same canonical bytes it displays. Accessibility and security turned out to reinforce each other, since a single deliberate wrist gesture is both easier to use and harder to spoof. Being transparent about limitations also builds credibility.
What's next for ClawPay
Next we plan live PayPal validation and partner pilots, plus phone approval for orders above the per-order limit. We will store spoken budgets as signed policy and re-check passports at approval time, and add multi-hop delegation, cascade revocation and Agent Passport System conformance testing. Further out are AP2 mandates and ACP/UCP adapters, risk-based approval tiers (face check, typed code, second approver), secure-element hardware and a caregiver mode. Long term, ClawPay becomes an SDK and API approval layer, with phone, desktop and passkey approvers as the mass-market tier and dedicated hardware as the premium tier.
