smidgen

Blog

How an AI sets up smidgen after you sign up

You create the account. Then a coding agent runs npx @smidgendotio/cli login and init. There is no signup API, and the agent cannot change payout wallets on an existing project.

smidgen is a non-custodial USDC paywall. Humans pay in the browser. Bots and agents pay the same URL over HTTP 402. That part is settled.

The new part is the other kind of agent: a coding agent that can set up the paywall on your site after you have an account.

You still sign up yourself

There is no signup API. An agent that offers to “create the smidgen account for you” is inventing an endpoint.

Do this first:

  1. Open smidgen.io/login
  2. Sign in with email (magic link) or a wallet (MetaMask on Base, or Phantom on Solana)
  3. Confirm you can see the dashboard
  4. Come back to the agent and say you are signed in

Until that is done, the agent should wait.

Two agents, two jobs

Do not mix these:

  • Paying agents discover a paid URL, get HTTP 402, pay USDC, and retry. They never need a smidgen account. Guide: Pay as an agent.
  • Publisher coding agents help you ship a paywall on *your* site. You own the account. They hold a delegated token after you approve them. Spec: Have an AI set up smidgen.

If you asked Cursor or Claude to *buy* an article, that is the first path. If you asked it to *install* smidgen on your blog, that is the second.

What the agent actually runs

Once you are signed in, the preferred path is the CLI:

npx @smidgendotio/cli login
npx @smidgendotio/cli init --name "Blog" --site https://example.com --evm-wallet 0xYourBaseAddress --path "/premium/*" --stack next
npx @smidgendotio/cli doctor --url https://example.com/premium

login is RFC 8628 device authorization. It prints a URL and a short user code. You open smidgen.io/device, click Authorize, and a smid_ag_… token is stored in ~/.smidgen/credentials.json (not git). It lasts 90 days and you can revoke it.

init creates the project and a paywall rule, writes .env.local (gitignored), and for --stack next writes middleware.ts if it is missing. Ask the agent for the site URL and payout wallet *before* this step. Stacks: next (default), html, wordpress.

doctor GETs your URL as a bot and expects HTTP 402.

Raw HTTP is documented if the CLI cannot run. Same device flow, same scopes.

What the agent cannot do

The token is a delegated operator, not you.

  • It cannot create the account
  • It cannot change payout wallets on an existing project
  • It cannot change billing or delete the account
  • It cannot use a Publisher API key (smid_sk_) as an agent token

Scopes are projects:read, projects:write, rules:write, keys:write. If you need to move a payout address later, do it in the dashboard.

Do not paste magic-link URLs or session cookies into chat. Do not commit smid_ag_ or smid_sk_ tokens.

After init

You still have to ship the adapter on your origin (Next.js middleware, WordPress plugin, nginx, and so on). The CLI can write the Next file; WordPress still needs the plugin and a rule sync.

Then curl the page without a browser User-Agent. You want HTTP 402. Serve /.well-known/ai-catalog.json from your rules so paying agents can find the URL. The first real settle can list it on Coinbase Bazaar.

If you want to see the buyer side first, try the live demos before you integrate.

Links for agents