# Send Sponge Wallet to your agent
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
## Fast path
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
## Suggested prompts
### New install

```text
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
```
### Upgrade existing

```text
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
```
## Machine-readable fields
```json
{
  "schemaVersion": "1.0",
  "item": {
    "slug": "wallet-skills",
    "name": "Sponge Wallet",
    "source": "tencent",
    "type": "skill",
    "category": "开发工具",
    "sourceUrl": "https://clawhub.ai/rishabluthra/wallet-skills",
    "canonicalUrl": "https://clawhub.ai/rishabluthra/wallet-skills",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadUrl": "/downloads/wallet-skills",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=wallet-skills",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "packageFormat": "ZIP package",
    "primaryDoc": "SKILL.md",
    "includedAssets": [
      "SKILL.md"
    ],
    "downloadMode": "redirect",
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-05-07T17:22:31.273Z",
      "expiresAt": "2026-05-14T17:22:31.273Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-annual-report",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-annual-report",
        "contentDisposition": "attachment; filename=\"afrexai-annual-report-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/wallet-skills"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    }
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/wallet-skills",
    "downloadUrl": "https://openagent3.xyz/downloads/wallet-skills",
    "agentUrl": "https://openagent3.xyz/skills/wallet-skills/agent",
    "manifestUrl": "https://openagent3.xyz/skills/wallet-skills/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/wallet-skills/agent.md"
  }
}
```
## Documentation

### Sponge Wallet API - Agent Skills Guide

This skill is doc-only. There is no local CLI. Agents must call the Sponge Wallet REST API directly.

### Why the steps matter (short rationale)

Register vs login: agents create a new managed wallet tied to a human owner. That owner must explicitly claim the agent. Login is only for humans who already have an account.
Claim URL: ensures the human owner explicitly links the agent to their account and controls allowlists/funding.
Credential persistence: the apiKey is returned once (immediately for agent-first mode, or after device approval for standard mode). If you lose it, you must re-register or re-authenticate.

### Standard credential storage (required)

Store the API key in one canonical location:

~/.spongewallet/credentials.json

Recommended file contents:

{
  "apiKey": "sponge_live_...",
  "claimCode": "ABCD-1234",
  "claimUrl": "https://wallet.paysponge.com/device?code=ABCD-1234"
}

Optional environment export (runtime convenience):

export SPONGE_API_KEY="$(jq -r .apiKey ~/.spongewallet/credentials.json)"

### Base URL & Auth

Base URL: https://api.wallet.paysponge.com
Auth header: Authorization: Bearer <SPONGE_API_KEY>
Content-Type: application/json

Quick env setup:

export SPONGE_API_URL="https://api.wallet.paysponge.com"
export SPONGE_API_KEY="$(jq -r .apiKey ~/.spongewallet/credentials.json)"

### 1) Agent Registration (AI agents only)

There are two modes:

Standard device flow (default): human must approve before the API key is returned.
Agent-first (agentFirst: true): agent receives the API key immediately, and the human can claim later.

Step 1 — Start registration (agent-first recommended)

curl -sS -X POST "$SPONGE_API_URL/api/agents/register" \\
  -H "Content-Type: application/json" \\
  -d '{
    "name":"YourAgentName",
    "agentFirst": true,
    "testnet": true
  }'

Response includes:

verificationUriComplete (claim URL for the human owner)
claimCode, deviceCode, expiresIn, interval, claimText
apiKey (returned immediately in agent-first mode)

Store apiKey, claimCode, and verificationUriComplete (as claimUrl) in ~/.spongewallet/credentials.json so a human can claim later if context resets.

Step 2 — Send the claim URL to the human owner
They log in, optionally post the tweet text, and approve the agent.

Claim link format:

verificationUriComplete (example path: /device?code=ABCD-1234)
The base URL is the frontend (prod or local), so just pass the full verificationUriComplete to the human.

Step 3 — Poll for completion (standard device flow only)

curl -sS -X POST "$SPONGE_API_URL/api/oauth/device/token" \\
  -H "Content-Type: application/json" \\
  -d '{
    "grantType":"urn:ietf:params:oauth:grant-type:device_code",
    "deviceCode":"<deviceCode>",
    "clientId":"spongewallet-skill"
  }'

On success, the response includes apiKey. Save it to ~/.spongewallet/credentials.json and use it as SPONGE_API_KEY.

Note: In agent-first mode, you already have the apiKey from Step 1. The device token will remain pending until the human claims.

### 2) Human Login (existing accounts only)

Phase 1 — Request device code

curl -sS -X POST "$SPONGE_API_URL/api/oauth/device/authorization" \\
  -H "Content-Type: application/json" \\
  -d '{
    "clientId":"spongewallet-skill",
    "scope":"wallet:read wallet:write transaction:sign transaction:write"
  }'

Phase 2 — Poll for token (same endpoint as agents)

curl -sS -X POST "$SPONGE_API_URL/api/oauth/device/token" \\
  -H "Content-Type: application/json" \\
  -d '{
    "grantType":"urn:ietf:params:oauth:grant-type:device_code",
    "deviceCode":"<deviceCode>",
    "clientId":"spongewallet-skill"
  }'

### Tool Call Pattern

All tool calls are plain REST requests with JSON payloads.

Common headers

-H "Authorization: Bearer $SPONGE_API_KEY" \\
-H "Content-Type: application/json" \\
-H "Accept: application/json"

Agent ID note: agentId is optional for API key auth. It is only required when using a user session (e.g., Privy-based auth) or when explicitly operating on a different agent.

### Tool -> Endpoint Map

ToolMethodPathParams/Bodyget_balanceGET/api/balancesQuery: chain, allowedChains, onlyUsdcget_solana_tokensGET/api/solana/tokensQuery: chainsearch_solana_tokensGET/api/solana/tokens/searchQuery: query, limitevm_transferPOST/api/transfers/evmBody: chain, to, amount, currencysolana_transferPOST/api/transfers/solanaBody: chain, to, amount, currencysolana_swapPOST/api/transactions/swapBody: chain, inputToken, outputToken, amount, slippageBpsbase_swapPOST/api/transactions/base-swapBody: chain, inputToken, outputToken, amount, slippageBpsbridgePOST/api/transactions/bridgeBody: sourceChain, destinationChain, token, amount, destinationToken, recipientAddressget_transaction_statusGET/api/transactions/status/{txHash}Query: chainget_transaction_historyGET/api/transactions/historyQuery: limit, chainrequest_fundingPOST/api/funding-requestsBody: amount, reason, chain, currencywithdraw_to_main_walletPOST/api/wallets/withdraw-to-mainBody: chain, amount, currencyx402_fetchPOST/api/x402/fetchBody: url, method, headers, body, preferred_chaindiscover_x402_servicesGET/api/x402/discoverQuery: type, limit, offset, include_catalogpolymarketPOST/api/polymarketBody: action, + action-specific params (see below)amazon_checkoutPOST/api/checkoutBody: checkoutUrl, amazonAccountId, shippingAddress, dryRun, clearCartget_checkout_statusGET/api/checkout/{sessionId}Query: agentId (optional)get_checkout_historyGET/api/checkout/historyQuery: agentId, limit, offsetamazon_searchPOST/api/checkout/amazon-searchBody: query, maxResults, region

Note: request bodies use camelCase (e.g., inputToken, slippageBps).

### Polymarket Actions

The polymarket endpoint is a unified tool. Pass action plus action-specific parameters:

ActionDescriptionRequired ParamsOptional ParamsstatusCheck Polymarket account status and USDC.e balance——marketsSearch prediction markets—query, limitpositionsView current market positions——ordersView open and recent orders——orderPlace a buy/sell orderoutcome, side, size, pricemarket_slug or token_id, order_typecancelCancel an open orderorder_id—set_allowancesReset token approvals——withdrawWithdraw USDC.e from Safe to any addressto_address, amount—

Order params:

market_slug: Market URL slug (e.g., "will-bitcoin-hit-100k") — use this OR token_id
token_id: Polymarket condition token ID — use this OR market_slug
outcome: "yes" or "no"
side: "buy" or "sell"
size: Number of shares (e.g., 10)
price: Probability price 0.0–1.0 (e.g., 0.65 = 65 cents per share)
order_type: "GTC" (default), "GTD", "FOK", "FAK"

Scopes: Trade actions (order, cancel, set_allowances, withdraw) require polymarket:trade scope. Read actions (status, markets, positions, orders) require polymarket:read.

Auto-provisioning: The Polymarket Safe wallet is created automatically on first use. No manual setup needed.

### Amazon Checkout

Purchase products from Amazon using a configured Amazon account.

Prerequisites:

An Amazon account must be configured via the dashboard or /api/agents/:id/amazon-accounts endpoints
A shipping address must be set (inline or via /api/agents/:id/shipping-addresses)

Async workflow:

Initiate checkout with POST /api/checkout — returns a sessionId
Wait ~60 seconds for the initial checkout process
Poll GET /api/checkout/:sessionId every 10 seconds until status is completed or failed

Status progression: pending → in_progress → completed | failed | cancelled

Key options:

dryRun: true — stops before placing the order (useful for testing or previewing total cost)
clearCart: true — clears the Amazon cart before adding the product (default behavior)

Scopes: Checkout actions require amazon_checkout scope on the API key.

### 1) Register (agents only)

curl -sS -X POST "$SPONGE_API_URL/api/agents/register" \\
  -H "Content-Type: application/json" \\
  -d '{
    "name":"YourAgentName",
    "agentFirst": true,
    "testnet": true
  }'

Share the claim URL with your human, then store the apiKey immediately (agent-first). For standard device flow, poll for the token after approval.

### 2) Check balance

curl -sS "$SPONGE_API_URL/api/balances?chain=base" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Accept: application/json"

### 3) Transfer USDC on Base

curl -sS -X POST "$SPONGE_API_URL/api/transfers/evm" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "chain":"base",
    "to":"0x...",
    "amount":"10",
    "currency":"USDC"
  }'

### Swap tokens on Solana

curl -sS -X POST "$SPONGE_API_URL/api/transactions/swap" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "chain":"solana",
    "inputToken":"SOL",
    "outputToken":"BONK",
    "amount":"0.5",
    "slippageBps":100
  }'

### Swap tokens on Base

curl -sS -X POST "$SPONGE_API_URL/api/transactions/base-swap" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "chain":"base",
    "inputToken":"ETH",
    "outputToken":"USDC",
    "amount":"0.1",
    "slippageBps":50
  }'

### Bridge tokens cross-chain

curl -sS -X POST "$SPONGE_API_URL/api/transactions/bridge" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "sourceChain":"solana",
    "destinationChain":"base",
    "token":"SOL",
    "amount":"0.1",
    "destinationToken":"ETH"
  }'

### Check transaction status

curl -sS "$SPONGE_API_URL/api/transactions/status/0xabc123...?chain=base" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Accept: application/json"

### Polymarket — Check status

curl -sS -X POST "$SPONGE_API_URL/api/polymarket" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"action":"status"}'

### Polymarket — Search markets

curl -sS -X POST "$SPONGE_API_URL/api/polymarket" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"action":"markets","query":"bitcoin","limit":5}'

### Polymarket — Place an order

curl -sS -X POST "$SPONGE_API_URL/api/polymarket" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "action":"order",
    "market_slug":"will-bitcoin-hit-100k",
    "outcome":"yes",
    "side":"buy",
    "size":10,
    "price":0.65
  }'

### Polymarket — View positions

curl -sS -X POST "$SPONGE_API_URL/api/polymarket" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"action":"positions"}'

### Polymarket — Withdraw USDC.e

curl -sS -X POST "$SPONGE_API_URL/api/polymarket" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "action":"withdraw",
    "to_address":"0x...",
    "amount":"10.00"
  }'

### Amazon Checkout — Initiate purchase

curl -sS -X POST "$SPONGE_API_URL/api/checkout" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "checkoutUrl":"https://www.amazon.com/dp/B0EXAMPLE",
    "dryRun":true,
    "clearCart":true
  }'

### Amazon Checkout — Poll status

curl -sS "$SPONGE_API_URL/api/checkout/<sessionId>" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Accept: application/json"

### Amazon Checkout — Get history

curl -sS "$SPONGE_API_URL/api/checkout/history?limit=10" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Accept: application/json"

### Amazon — Search products

curl -sS -X POST "$SPONGE_API_URL/api/checkout/amazon-search" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"query":"wireless mouse","maxResults":5}'

### x402 Fetch (auto-pay for paid APIs)

curl -sS -X POST "$SPONGE_API_URL/api/x402/fetch" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "url":"https://api.paysponge.com/api/services/purchase/svc_abc123/polymarket/markets?search=bitcoin&limit=5",
    "method":"GET",
    "preferred_chain":"base"
  }'

The x402_fetch tool handles the entire payment flow automatically:

Makes the HTTP request to the specified URL
If the service returns 402 Payment Required, extracts payment requirements
Creates and signs a USDC payment using the agent's wallet (Base or Solana)
Retries the request with the Payment-Signature header
Returns the final API response with payment_made and payment_details

### Discover x402 services (Bazaar)

curl -sS "$SPONGE_API_URL/api/x402/discover?limit=10" \\
  -H "Authorization: Bearer $SPONGE_API_KEY" \\
  -H "Accept: application/json"

Returns available x402-enabled services from the Bazaar and Sponge's curated catalog. Use this to find paid APIs before calling x402_fetch.

### Chain Reference

Test keys (sponge_test_*): sepolia, base-sepolia, solana-devnet, tempo
Live keys (sponge_live_*): ethereum, base, solana

### Error Responses

Errors return JSON with an error message and HTTP status:

{"error":"message"}

StatusMeaningCommon Cause400Bad RequestMissing/invalid fields401UnauthorizedMissing or invalid API key403ForbiddenAddress not in allowlist or permission denied404Not FoundResource does not exist409ConflictDuplicate action429Rate LimitedToo many requests (back off + retry)500Server ErrorTransient; retry later

### Security

Never share your API key in logs, posts, or screenshots.
Store your API key in ~/.spongewallet/credentials.json and restrict file permissions.
Rotate the key if exposure is suspected.

Built for agents.
## Trust
- Source: tencent
- Verification: Indexed source record
- Publisher: rishabluthra
- Version: 0.1.2
## Source health
- Status: healthy
- Source download looks usable.
- Yavira can redirect you to the upstream package for this source.
- Health scope: source
- Reason: direct_download_ok
- Checked at: 2026-05-07T17:22:31.273Z
- Expires at: 2026-05-14T17:22:31.273Z
- Recommended action: Download for OpenClaw
## Links
- [Detail page](https://openagent3.xyz/skills/wallet-skills)
- [Send to Agent page](https://openagent3.xyz/skills/wallet-skills/agent)
- [JSON manifest](https://openagent3.xyz/skills/wallet-skills/agent.json)
- [Markdown brief](https://openagent3.xyz/skills/wallet-skills/agent.md)
- [Download page](https://openagent3.xyz/downloads/wallet-skills)