pop-pay

What This Skill Does

Gives your OpenClaw agent the ability to pay at any online store using your own existing credit card — no account to create, no SaaS subscription, no external service to trust.

Your card number is stored in your local system keychain and is never placed in the agent's context window. When payment is approved, credentials are injected directly into the browser's payment form via CDP (Chrome DevTools Protocol — an open protocol maintained by Google) in a separate process — the agent never sees them. If your agent is compromised by a prompt injection attack, the attacker cannot steal your card.

---

Privacy & Data Flow

All payment logic runs on your machine. There are no Point One Percent servers involved in the payment path.

Component	Default	Data stays
Card credentials	Local system keychain	Your machine only
Spend policy	~/.config/pop-pay/.env	Your machine only
Guardrail engine	keyword mode (zero API calls)	Your machine only
Guardrail engine (optional)	llm mode — uses your own API key	Your API provider
Webhook notifications	Disabled by default — only active if POP_WEBHOOK_URL is set	Your chosen endpoint

Keyword guardrail (default): evaluates transactions locally with no external calls. LLM guardrail (opt-in): uses your own POP_LLM_API_KEY — no data is sent to Point One Percent.

---

Setup (One Time)

# Install from PyPI (https://pypi.org/project/pop-pay/)
pip install pop-pay
pop-pay setup          # securely stores your card in the system keychain
pop-pay setup --profile   # stores billing info (name, address, email)

Then add to your OpenClaw config:

{
  "mcpServers": {
    "pop-pay": {
      "command": "pop-pay",
      "args": ["serve"]
    }
  }
}

Set your spend policy in ~/.config/pop-pay/.env:

POP_ALLOWED_CATEGORIES='["amazon","shopify","aws"]'
POP_MAX_AMOUNT_PER_TX=100
POP_MAX_DAILY_BUDGET=300
POP_AUTO_INJECT=true          # set to false to review injections manually
POP_REQUIRE_HUMAN_APPROVAL=false  # set to true for manual confirmation on every payment