Descout
Back to Guides
Guide··5 min read

How Kite's Agent Passport works on its Avalanche L1

Kite Agent Passport pays x402 services from a USDC.e wallet under a passkey-approved session with a total budget, a per-transaction cap and an expiry; Avalanche says a service checking the passport cannot tell which human is behind the agent unless disclosure is opted into.

Drafted by the Descout article deskHow this was made
Share:
How Kite's Agent Passport works on its Avalanche L1 - Tutorial and guide

Kite Agent Passport lets an AI agent pay for an API call from a wallet its owner funded, under a spending session the owner approves with a passkey. Kite's docs describe the flow: the owner sets a budget, a per-transaction limit and a time window, and the agent handles discovery, payment and fulfillment until the session expires or the budget runs out. The settlement layer is Kite Chain, which Avalanche says launched its mainnet on April 28, 2026 as a sovereign Avalanche L1. More on the project is on the GoKite AI entity page.

What Kite Chain and Passport are

Avalanche's launch post describes Kite's mainnet as "a dedicated Avalanche L1 designed for continuous, programmatic transactions between agents, services, and digital marketplaces," with Kite Passport alongside it for agent identity and controlled authority (Avalanche, April 28, 2026). The same post says Kite processed more than 1.9 billion agent interactions across its testnet phases. Kite's mainnet network page lists chain ID 2366 and the KITE token symbol (Kite docs).

Kite announced a $18 million Series A on September 2, 2025, bringing cumulative funding to $33 million, led by PayPal Ventures and General Catalyst (PayPal newsroom).

Three identity layers

Kite's core concepts page splits authority into three levels:

  1. User (root). The owner's wallet key. Kite's docs say it lives in secure enclaves, hardware security modules or protected device storage and is never exposed to agents or services.
  2. Agent (delegated). Each agent gets a deterministic address derived from the user's wallet with BIP-32 key derivation. Anyone can verify that the agent belongs to the user, and the agent cannot reverse the derivation to reach the parent key.
  3. Session (ephemeral). A random key created per task, never derived from the agent or user keys. Kite's docs say it carries a scope such as a maximum amount, a recipient set and a narrow time window, then becomes invalid when the window ends.

Avalanche's technical deep dive, published April 28, 2026, adds a fourth object: a Delegation, a signed payment intent tied to a parent session. Its example: a session allows up to $500 on a flight within an hour, and a delegation spends exactly $350 on one route. The post says an agent can sub-delegate to a specialized agent whose authority is bound by both the session and the parent delegation.

Kite's docs describe the signature chain services check: a Standing Intent signed by the user, a Delegation Token signed by the agent (typically valid 60 seconds), and a Session Signature over the transaction. Services verify all three.

Creating a session

The payments guide walks through the CLI flow:

  1. Install the kpass CLI and set up a passkey.
  2. Fund the Passport wallet (below).
  3. Search the catalog with ksearch service list.
  4. Run kpass session create with a task summary, --max-amount-per-tx, --max-total-amount and --ttl. The docs' example is a $2 per-transaction cap, a 10 total and a 24-hour TTL.
  5. Open the returned approval URL on a device that holds your passkey and approve.
  6. Run kpass session execute --url <endpoint>; the request is paid per the service's x402 pricing.

If a request breaks the rules, the backend refuses it. The error codes page lists session_rule_exceeded (over the per-transaction limit), session_total_exceeded (budget exhausted) and session_endpoint_forbidden (outside the session's endpoint constraints). In each case the agent has to present new session parameters to the user and wait for confirmation before creating another session.

Approval is also hardened. Kite's June 4, 2026 backend release made session approval require a fresh passkey assertion bound to the exact operation, and made session caps USD-denominated.

How an x402 payment flows

Kite's service provider guide gives the sequence:

  1. Per the guide, the agent calls a service endpoint and the service returns HTTP 402 Payment Required with its terms: scheme, network, maximum amount, payee address, asset and timeout.
  2. The agent obtains a signed payment authorization from the user's session.
  3. The agent resends the request with an X-Payment header holding a base64-encoded authorization.
  4. The service verifies the token and calls a facilitator to settle. Kite names the Pieverse facilitator as its recommended option for Kite Chain; it calls transferWithAuthorization and moves funds to the service's wallet.
  5. The service delivers the response.

The guide says Passport can also pay services that implement MPP, the Machine Payments Protocol that Kite describes as co-authored by Stripe and Tempo.

What the service sees

Avalanche's deep dive says a service can verify that an agent has a valid, active passport, that the passport is backed by a verified human, and that the agent is within its declared spending constraints. It says the service cannot learn which specific human is behind the agent from that check alone, and that fuller identity disclosure is opt-in per session. Kite's core concepts page lists the same property as selective disclosure. Neither source specifies the proof system used.

Settlement asset and funding

Kite's funding page says the Passport wallet needs USDC.e on Kite Chain. It lists three routes: buying USDC by card, depositing stablecoins from other chains to Passport deposit addresses, and moving funds through Kite Bridge. A direct transfer on Kite Chain needs KITE tokens for gas. Per the June 4, 2026 release notes, the agent never names a settlement token; the merchant chooses the settlement stablecoin at transaction time.

Not published

The sources do not say how the verified-human proof is constructed, what fee a service pays at settlement, or how many services are in the catalog today.

Sources

Share: