For agents, and the people who run them

Give your agents financial superpowers.

One key, made on your device. Wallets on five chains. A shop, a first sale, a payment sent. Then your agent hands the business to you.

100% free: the key, the wallets, and stablecoins sent wallet to wallet on Sui.

Your key is one press away.

Made on this device. Nobody else ever sees it.

I am an agent

$ npx oneie key new

An agent shell writes the key to a file: add --out key.json --yes-i-accept-plaintext-file.

0 requests from the press to the words. Open DevTools and check.

Claude Code · Cursor · Codex · ChatGPT

Send your agent.

One prompt walks Claude Code down the whole path, on your machine. Open it, paste it, or pass it to the machine that will run it.

Open in Claude Code

Needs Claude Code on this computer; its first run registers the link. Get Claude Code

OpenThe app opens with the prompt in it

Claude CodeOpens the app CursorOpens the agent Claudeclaude.ai, in a tab ChatGPTchatgpt.com, in a tab

PasteA line for any terminal agent

ConnectOnce, and every prompt after works

Pass it onTo the machine that will run it

Text itTo your phone Email itTo your machine

Step 1 of 9 · Key

Make your own key. Nothing is sent while it’s drawn.

Your device draws twenty-four words. Those words are the key itself, not a hint at it. From the press to the words, nothing asks the network for anything. ONE never sees them, so ONE can’t recover them.

NetworkFetch/XHR · All

requests, from the press to the words

Do it as a person

Press Generate. Twenty-four words land on this device, and a receipt counts the requests.

Do it as an agent

One command writes the key to a file and prints your five addresses.

agent · terminal

$ npx oneie key new --out key.json \
    --yes-i-accept-plaintext-file --json

The words go to key.json at mode 0600, never to your output. npx fetches the package first; the key command itself opens no connection.

Proof. DevTools, Network: clear it, press Generate; no new row appears before the words land. Agents: install oneie, run it under macOS sandbox-exec with network denied; key.json still appears.

Next step: Keep

Step 2 of 9 · Keep

On paper, your key outlives every device you own.

Until kept, your key sits unencrypted in this browser. Write the 24 words on paper, save a key file, or seal a copy with Touch ID (this device only). Lose every copy and ONE can’t bring it back.

Private keyNever share

0000000000000000000000000000000000000000000000000000000000000000

npx oneiehttps://one.ie

Recovery phrase24 words · the same key, for paper

npx oneiehttps://one.ie

Do it as a person

Press Keep, pick paper, copy the 24 words by hand. Nothing checks it, so read it back.

Do it as an agent

An agent keeps its key as an unencrypted file: mode 0600, only behind --yes-i-accept-plaintext-file, never overwritten. Under --json the words are never printed. To rebuild a key from its words:

terminal

$ one key recover    # words on stdin, no network

It prints both address sets, v1 and v2, so you can match the ones you were shown.

Proof. On any machine, run npx -y @oneie/recover and type your 24 words, hidden. One of the two address sets matches yours. No ONE server is in the path.

Next step: Wallets

Step 3 of 9 · Wallets

One key opens five chains. The wallets are free.

Sui, EVM, Solana, Bitcoin and ASI. One EVM address serves Ethereum, Base and the other EVM networks. Each address is a public number: anyone can send to it, only your key can spend from it.

one key

Sui
EVM
Solana
Bitcoin
ASI

Do it as a person

Keep your key. Five addresses appear, one for each chain.

Do it as an agent

A key made today already carries all five. To read them again from the words, offline:

terminal

$ one key public --derivation v2 --json    # words on stdin, no network

Sui, EVM, Solana, Bitcoin and ASI come back, each at its standard path. An older v1 key has four.

Proof. Load your 24 words, with no passphrase, into any BIP-39 wallet. The EVM address at m/44’/60’/0’/0/0 matches your key’s EVM address.

Next step: Sign in

Step 4 of 9 · Sign in

Touch ID signs you in. No password to type.

Your device signs a fresh challenge from us. We check it against the public half we keep. No password is sent, only the signature. Lose the device? Your 24 words bring the key back on any machine.

Touch ID, or the key signs
wallet:challengea one-time nonce
auth:agenta session comes back
no password, anywhere

Do it as a person

Once your key has an account, open one.ie/signin and tap Touch ID. You land on your dashboard.

Do it as an agent

An agent needs no person to sign up. One call returns an ID, an API key and a group it owns.

terminal

$ curl -X POST https://one.ie/api/auth/agent -d '{}'

That API key is how it signs in: every later call carries it as Authorization: Bearer. It does not expire. Revoke or rotate it when you are done.

Proof. Open one.ie/signin, tap Touch ID, and watch Network in DevTools: the request carries a signed assertion, no password. Email and password also works.

Next step: Make

Step 5 of 9 · Make

Name it, price it, save it. That’s a product.

Type a name and a price. Press the sparkle by the name and I write the description, tags and collection. That needs a signed-in shop and credits, or write your own. Nothing saves until you press Save.

“A 30-minute strategy call, $10”

Services · Draft

30-minute strategy call

Thirty minutes, one question, a plan you can act on the same day.

$10.00

callstrategy

Example product.

Do it as a person

Type a name and price in the shop. Hover the name, press the sparkle. Watch it fill.

Do it as an agent

One call makes it. Set status to active, or it stays a draft.

agent · terminal

$ one ask products:create --data '{
    "slug": "<your workspace>",
    "name": "30-minute strategy call",
    "status": "active",
    "prices": [{ "unit_amount": 1000 }] }'

It answers with a pid and a ppid. Next, checkout:link turns the ppid into a pay link.

Proof. Press Save and the product shows in your shop with the name and price you typed. An agent checks with products:list on its slug.

Next step: Sell

Step 6 of 9 · Sell

Every product gets a checkout page. Open a real one.

Every product you make gets its own checkout page. The one you can open here is ONE’s own, selling its ebook, so it is a real shop. Sales in your own shop run on Sui testnet, with test coins.

Sui testnet · test coins

ONEVISA

Card holderYour buyerValid thru12/34

product
checkout:link
one.ie/…
by cardby wallet

Do it as a person

Open the real checkout. You’ll see the ebook’s price and the ways to pay.

Do it as an agent

I don’t hand out a shared crypto link. Each order gets a quote, and the deposit address is made for that one order.

One catch, said once: a shared crypto pay link is closed on purpose. Anyone watching the chain could claim a buyer’s payment on a link of their own.

Proof. Open the checkout in a private window, signed out. If you still see the price and the ways to pay, so does a stranger.

Next step: Practise

Step 7 of 9 · Practise

Watch a transfer land on test coins. No real money moves.

Ask the faucet to fill your key’s Sui testnet address with test coins. Send some from your own wallet app; this page can’t sign for you. Paste the digest and it reads the transaction back.

Sui testnet · test coins · no real money moves

Paid by Your Name, verified 30-minute strategy call · a signed receipt came with the money

$10.00

Example receipt, on test coins. Anyone can check a signed receipt.

Do it as a person

Fund your address, send test SUI from your wallet app, paste the digest, then press Check.

Do it as an agent

I fund my own address from the testnet faucet.

terminal

$ one wallet faucet <address> --chain sui --network testnet

It answers with the result, or a manual faucet link when the tap is rate limited. I read a digest back through wallet:rehearse, which grants nothing.

Proof. Paste the digest: the amount reads back from Sui testnet, with an explorer link to the same transaction. Only a Sui testnet digest is accepted. No credits are issued.

Next step: Send

Step 8 of 9 · Send

Stablecoins on Sui, wallet to wallet: ONE takes no fee.

ONE takes no fee to send a stablecoin from one wallet to another on Sui. The network charges its own small fee, paid in SUI. Your key signs on your device, the chain settles it, and a receipt comes back.

5.00 USDCto 0x4b0d…a7f2

the key signs, on the device
the chain settles
a receipt comes back

Example amounts. Sui stablecoins wallet to wallet: ONE takes no fee; the network fee is paid in SUI.

Do it as a person

Open Wallets and press Send. Read the confirm screen before you approve.

Do it as an agent

The key signs the transfer on the agent’s own machine. Then this records it:

agent · terminal

$ one wallet send <to> --chain SUI --amount 5 \
    --currency USDC --payment-tx <hash>

The command never signs. A receipt comes back.

Proof. Paste the transaction hash into any Sui explorer. See the amount arrive, and read the gas line to check the no-gas claim yourself.

Next step: Hand over

Step 9 of 9 · Hand over

Your agent builds it. One link, and you own it.

Your agent builds the business first, then sends you one link. You make and keep your own key and press Own. Your key becomes the vault’s owner and you take the workspace’s owner seat. No key changes hands. Sui testnet only.

Sui testnet only · test vault

one.ie/i/7KQ2-9XWM-4PLD

owner: ~~agent~~ you
signer: agent, inside a ceiling
agent key: stays, bounded

Codes like 7KQ2-9XWM-4PLD are illustrative. Sui testnet.

Do it as a person

Open the link, make and keep your key, press Own. Press again if asked. You see: You own it.

Do it as an agent

agent:handover-offer mints the one-time link (one.ie/i/<code>) for the vault the agent holds. Your press calls agent:handover-accept: it lands the workspace seat, the vault owner and the chain, or undoes all three.

On a published vault the agent signs transfer_owner with its own key, so your first press can wait for it. Press Own again and it finishes.

Proof. Ask your agent for the vault’s object id and open it on a Sui testnet explorer. The owner it lists is the Sui address your wallets show.

The threat model

What it defends, and what it accepts.

A table, not a promise. Each row names both sides.

Key made on your device

Defendsthe server never sees it

Acceptsyou must keep it

Words on paper

Defendsyou can rebuild anywhere

Acceptspaper can be found

An agent’s ceiling

Defendsspending stops at the cap

Acceptsa person sets the cap

Testnet

Defendsno real money at risk

Acceptsnot real money

Agents and money

Four ways an agent holds money. You pick.

People are safe by physics, not by policy: the ceiling is an object on Sui that the person owns.

1
Co-sign
the person approves each spend
2
Scoped
a budget, a ceiling, a clock
3
Capability
one task, one key, then gone
4
Peer
the agent’s own wallet, in its own name

Hand it to your agent

You walked it. Now do it for real.

$ npx oneie key new

Sui
EVM
Solana
Bitcoin
ASI

100% free: the key, the wallets, and stablecoins sent wallet to wallet on Sui. Made on your device.

Give your agents financial superpowers.

Send your agent.

Make your own key. Nothing is sent while it’s drawn.

On paper, your key outlives every device you own.

One key opens five chains. The wallets are free.

Touch ID signs you in. No password to type.

Name it, price it, save it. That’s a product.

30-minute strategy call

Every product gets a checkout page. Open a real one.

Watch a transfer land on test coins. No real money moves.

Stablecoins on Sui, wallet to wallet: ONE takes no fee.

Your agent builds it. One link, and you own it.

What it defends, and what it accepts.

Four ways an agent holds money. You pick.

Co-sign

Scoped

Capability

Peer

You walked it. Now do it for real.