Skip to main content
A Delegate is the subscription-backed option for AI agents. The subscription owner keeps the cold key and prepaid plan; the agent holds a hot key that can authorize gateway rounds within a limit the owner sets on chain and the gateway enforces. This is the alternative to x402 pay-per-request. Use a delegate when someone already pays for a Molpha subscription and wants the agent to spend that quota — not when the agent should pay USDC per request.

​
Use a delegate when

  • A team already has an active subscription.
  • The agent should not hold the owner’s USDC or subscription key.
  • You want a cap on how many rounds the agent can request.
  • Rounds should be admitted by the gateway against the subscription and delegate request quota.

​
On-chain account

Seeds:
Create with add_delegate and remove with remove_delegate, which closes the account. There is no pause instruction. add_delegate requires an active subscription, a delegate key different from the owner, max_data_requests greater than 0, and a free slot under the subscription’s max_delegates.

​
Flow

  1. Owner opens or extends a subscription.
  2. Owner calls add_delegate with the agent pubkey and max_data_requests.
  3. Agent (as consumerAuthority, with subscriptionOwner set to the owner) signs RequestAuth (authSig + authTimestamp, unix seconds) and calls POST /v1/round/execute; the gateway assigns the round’s timestamp.
  4. Gateway serves the signed payload.
  5. The round counts against the subscription’s max_rounds and the delegate’s max_data_requests (see Admission).
Where the gateway enables sign-in sessions (GET /v1/info reports sessionAuth: true), the agent can request a sign-in challenge that names its owner, sign it, exchange it at POST /v1/session, and send the bearer token instead of RequestAuth. Delegate access is still checked against chain state on every round. The sourceId is the canonical API-config hash only. Owner and delegate requests for the same apiConfig share it. The consumer key is part of the gateway’s replay identity, not of the source.

​
Controls

​
Next steps

Subscriptions

Open the plan that backs the delegate.

x402 pay-per-request

Pay-per-request path when there is no subscription.