X402SAFE

Open-source Python library for AI browser agents, plus Browser Use Cloud: stealth browsers and a hosted agent API.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: x402
description: Set up Browser Use Cloud payments with x402 — pay per request from a crypto wallet (USDC on Base mainnet), no signup or API key. Two setups it works out up front — "just use it" (set up a wallet so you or Claude Code can run cloud browser tasks paid from the wallet — Claude writes and runs throwaway scripts, nothing touches your codebase) or "build it in" (install the SDK and write the key + code into your project). Walks through wallet setup, funding, .env, and a ~$1 test run. Use when the user asks about x402, pay-per-use, USDC payments, or wants Browser Use Cloud without an API key. For the free-tier signup (reverse-CAPTCHA → API key), use `browser-use cloud signup` or the `cloud` skill instead.
allowed-tools: Bash, Read, Write, Edit
---

# Browser Use Cloud — pay with x402 (crypto wallet)

This is a scripted flow. Follow the steps in order. x402 only works through the **SDK** (`browser-use-sdk` for Python, the `browser-use` npm package for TS) — there is no `browser-use` CLI command for it, so every step runs a short SDK script.

## How to use this script

- Lines under **Say:** are spoken to the user **word for word.** Don't paraphrase, add, or drop anything.
- `<like this>` inside a Say block is a fill-in — replace it with the real value, keep the rest exact.
- Lines under **Ask:** use the AskUserQuestion tool. Use the question and option text exactly as written.
- **To show an explanation before a question, put it inside the AskUserQuestion `question` field** (it renders above the options). Don't send it as separate chat text before calling the tool — that text gets dropped when the question UI opens. So: explanation + the actual question both go in the `question` field, in one tool call.
- Lines under **Do:** are your actions. Don't read them out.
- Track two facts as you go: `SETUP` (A or B, from Step 1) and `MODE` (A or B, from Step 2).
- **`SETUP`, `MODE`, and the Path A/B/C names are internal labels for you only. Never say them to the user.** Describe choices in plain words instead (e.g. "top up your account" / "accountless wallet"), never "Mode B" or "Path A".

---

## Step 1 — Open and pick the setup

**Ask:** (header: `Use x402`) — put the explanation and the question both in the `question` field, exactly:

> x402 is a protocol from Coinbase that, instead of presenting an API key, allows you to use crypto to pay for API requests. x402 lets you pay Browser Use per request from a crypto wallet with USDC on Base — no signup, API key, or credit card needed, just a wallet. Setup takes a few minutes: get or make a wallet, add funds, save the key in `.env`, and test it.
>
> How do you want to use x402?
- **Just use it** — Run Browser Use tasks, paid from your wallet, here in terminal by asking me. I set up the wallet and key.
- **Build it in** — You're coding an app and want x402 in it. I will help you install the SDK, save the key to your project's `.env`, and add code.

**Do:** "Just use it" → `SETUP = A`. "Build it in" → `SETUP = B`.

---

## Step 2 — Find the account (check before asking)

**Do:** Look for an existing Browser Use API key, in this order. Don't say anything yet.
1. `BROWSER_USE_API_KEY` in the environment
2. a `BROWSER_USE_API_KEY=` line in `./.env`
3. `~/.browser-use/config.json` (saved by `browser-use cloud login` / `signup`)
4. `browser-use doctor` output, if the CLI is installed

**If no key is found anywhere:**

**Say:**
> No Browser Use key found, so I'll set this up accountless: the wallet is your identity, and the first payment makes a project named after it.

**Do:** `MODE = A`. Go to Step 3.

**If a key is found:**

**Ask:** (header: `Account`) — question: `I found a Browser Use API key in <location>. Where should the USDC credits go?`
- **Top up that account** — Credits go to your existing API key's project. Good if your free credits ran out, or you'd rather pay with crypto than a card.
- **Accountless wallet** — The wallet is a separate identity. The first payment makes a fresh project named after the wallet, apart from your existing account.

**Do:** "Top up that account" → `MODE = B`. "Accountless wallet" → `MODE = A`.

---

## Step 3 — Wallet

**Ask:** (header: `Wallet`) — question: `Do you have a wallet ready, or should I set one up?`
- **I have a funded wallet** — An EVM wallet (MetaMask, Rabby, Coinbase Wallet, Frame, Phantom, ...) with USDC on Base mainnet.
- **Walk me through it** — I'll guide you through making a wallet, adding Base, and buying USDC.
- **Make a fresh one** — I'll generate a throwaway wallet for automation. You'll still need to fund it.

Branch on the answer.

### Path A — "I have a funded wallet"

**Do:** Check `.env` is in `.gitignore`; add it if missing.

**Ask:** (header: `Add key`) — put the note and the question both in the `question` field:
> Your wallet's private key needs to go into `.env`. You can paste it here and I'll add it for you, or add it yourself. Heads up: anything pasted in chat is saved in the transcript, so for a high-value wallet, adding it yourself is a bit safer. How do you want to do it?

- **Paste it here** — Paste your private key in the chat and I'll write it to `.env` for you.
- **I'll add it myself** — You add it to `.env`, then send me just your public address.

**If "Paste it here":**

**Do:** Write `BROWSER_USE_X402_PRIVATE_KEY=<pasted key>` to `.env` (create the file if needed; make sure `.env` is gitignored). Never echo the key back or print it anywhere.

**Say:**
> Saved your key to `.env` — I won't print it back.

**Do:** Go to Step 4.

**If "I'll add it myself":**

**Say:**
> Add this line to your `.env`, then send me your wallet's public address (the `0x...` one — safe to share):
> ```
> BROWSER_USE_X402_PRIVATE_KEY=<your private key>
> ```

**Do:** When they send the address, check it matches `^0x[0-9a-fA-F]{40}$`.

**Say:**
> Got it: `<address>`. That's a valid address.

**Do:** Go to Step 4.

### Path B — "Walk me through it"

**Say:**
> 1. Install MetaMa

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: X402](https://modelsatlas.com/skills/browser-use/x402/badge.svg)](https://modelsatlas.com/skills/browser-use/x402/)

Not your listing, or something out of date? Claim or update your listing.