FlowGate — Money Streaming SDK for AI Agents on Sui

Problem Statement

The disagreement between Sam Altman and Elon Musk over OpenAI scraping X wasn't really about two billionaires. It exposed a structural problem with the AI economy: there is no programmatic way for a website or service to say "you can access my data, but you pay per second."

AI agents are consuming the internet — research, market data, social signals, legal databases — but the underlying payment infrastructure was built for humans. Credit cards require KYC. Monthly subscriptions aren't granular enough. API keys expose your business logic. And none of these work for an autonomous agent operating at machine speed without a human in the loop.

The question: what if an agent could just pay for what it needs, on the fly, the moment it needs it, and stop paying the moment it's done?

Solution

FlowGate is a money streaming SDK for AI agents on Sui. It gives autonomous agents their own wallets and lets them stream SUI micropayments per second of service access — without human approval, invoices, or billing cycles.

The core mechanic:

1. An AI agent tries to access a service.
2. It receives an HTTP 402 Payment Required response with streaming payment terms.
3. The FlowGate SDK intercepts this, automatically creates a StreamObject on Sui using the agent's own wallet.
4. The service middleware verifies the stream balance on-chain and grants access.
5. The moment the stream stops, access is revoked instantly.

No trust is required on either side — the payment and the access are the same object on-chain.

The SDK is platform-agnostic: any service that wants to charge AI agents per second of access can integrate FlowGate's x402 middleware in a few lines. The demo makes this concrete with a website-scraping marketplace — site owners list their URLs with a price per second, agents discover listings, open streams, and scrape. The demo is one instantiation; the SDK is the product.

Key Technical Facts

• Each agent gets its own Ed25519 keypair generated on creation — agents spend from their own wallets, not the user's.
• Payment streams are first-class Sui objects — StreamObject<T> is a generic Move struct that works with any coin type.
• Access control happens on-chain via a seal_approve_stream Move policy — there's no off-chain session, cookie, or trust.
• One command starts everything: docker compose up --build.

How We Built It

Sui Move contract — A generic StreamObject<phantom T> that holds the deposited coin, tracks rate per second, and uses sui::clock::Clock for time-based balance calculation. Deployed to Sui Testnet: 0xb05b3964df8b88a86cda6b192893399966014af9dd6fc6beb26f1343a0495495

FlowGate SDK (TypeScript) — Wraps @mysten/sui v2.x to handle the full agent payment lifecycle: intercept 402 → build PTB → create StreamObject → retry request with stream ID header → close stream and reclaim unspent funds. Uses SuiJsonRpcClient from @mysten/sui/jsonRpc with confirmed-working v2.x import patterns.

x402 Gateway (Express + Node.js) — Middleware that reads X-StreamEngine-Stream-Id from request headers, calls sui_getObject via RPC, extracts the stream balance from the Move object fields, and gates or denies access. Providers register their endpoints with a rate per second; agents discover them via GET /api/providers.

Agent wallet management — Server-side Ed25519 keypair generation per agent. Private keys are encrypted at rest with AES-256-CBC using a required AGENT_KEY_SECRET environment variable. Private keys never appear in API responses.

Persistence + deployment — SQLite via better-sqlite3 for agent and provider records that survive server restarts. Docker Compose runs the Node server and nginx-served React client as a two-container stack, with a named volume for the SQLite database. One command: docker compose up --build.

Frontend — React + Vite dashboard with two views: Provider Hub (list a website with price per second, watch live earnings) and Agent Terminal (browse listed sites, open streams, watch live balance, close and refund).

What We Learned

• Sui's object model is genuinely different from account-based chains, and it matters for this use case. A StreamObject isn't just a balance — it's an on-chain object that carries the payment terms, the recipient, the rate, and the deposited funds all together. Access control can be tied directly to object existence and balance. This is cleaner than anything you could build on Ethereum without a lot of extra infrastructure.
• Programmable Transaction Blocks are powerful but unforgiving. The ability to bundle coin splitting, object creation, and Move calls into a single atomic transaction is exactly what agent payment flows need. But getting the argument types right — especially the difference between tx.pure.address(), tx.pure.u64(), and tx.object() — requires reading the actual Move contract, not guessing.
• Multi-model AI coding across long sessions is a real coordination problem. Different models have different failure modes: some overclaim success without running tests, some introduce hardcoded secrets as convenience fallbacks, some get lost when the project context grows too large. The solution is maintaining an AGENTS.md file with verified technical facts, confirmed working code patterns, and explicit lists of what to trust vs verify.

What's Next for FlowGate

• Agent-to-agent streaming. The current flow is agent-to-service. The same SDK supports agent-to-agent payments — one AI service paying another for a capability, with no human intermediary. This is the foundation of an autonomous AI economy.
• Privacy layer via Sui Confidential Transfers. All streams are currently public on-chain — amounts and participants visible. Sui Confidential Transfers (currently in devnet beta as of June 2026) will hide stream amounts while preserving validity proofs. When this ships to mainnet, FlowGate streams inherit hidden amounts with no contract changes required.
• USDC and multi-token streams. The StreamObject<phantom T> contract is already generic. Supporting Circle USDC on Sui testnet is a type argument change — StreamObject<USDC> instead of StreamObject<SUI>. Stablecoin streams make pricing human-readable and remove volatility from agent budgets.
• On-chain provider registry. The current provider registry is off-chain (SQLite). contracts/sources/registry.move is written but not yet deployed. Migrating to an on-chain registry means any agent can discover any provider permissionlessly, without going through FlowGate's server.
• NPM package release. Publishing @flowgate/sdk so any platform can integrate agent payment streaming in three lines of TypeScript.

Built With

• sui