Login uses browser device approval and saves a key privately; ask the user to complete approval themselves. For an existing key, have them run pai login --paste locally, never paste it into chat. Agent configuration is temporary. Pai flags go before agent arguments, or --.

pai codex --key coding -- exec "review this repository"

Named-key selection uses PHANTOM_KEY_NAME, then PHANTOM_API_KEY, then the saved login key. An agent's explicit --key selects that local named key.

Fund a workspace

pai workspace fund --amount 10 --card
pai workspace fund --amount 10 --pay --x402
pai workspace payment --id <payment-id>

Card checkout needs the user. --pay needs an installed, configured pay.sh wallet; --x402 funds workspace credit with Solana USDC. --pay --mpp selects the other Solana funding protocol. These require the server's payment endpoint. Pai saves the purchase before paying. Check pending purchases instead of repaying.

Pay per request

pai codex --mpp --limit 10

Agent MPP payments use Tempo, separately from workspace funding. Wallet approval happens when needed. --limit defaults to 10 and limits session deposits; a new wallet access key uses that allowance for 7 days. Existing approvals may be reused. Do not describe it as a total run budget. --limit and --network require --mpp; --key cannot be combined with --mpp.

Control spending and keys

pai keys create --save coding --limit 5
pai keys list
pai keys set --id <key-id> --budget 20 --period 30 --rate 1
pai keys revoke --id <key-id>
pai keys saved
pai keys rm <name>
pai balance

Use the full ID from workspace key metadata. Key controls are enforced by the server; the rate is dollars per minute. Revocation preserves shared funds. keys saved lists local metadata; keys rm only forgets the local copy.

Route models

pai route
pai route set --models <model-a>,<model-b>
pai route rule add --if has_tools=true --use first
pai route test --table

Routing affects auto requests. Use PHANTOM_KEY_NAME=coding to manage the same key used by an agent with --key coding. Route tests are free.

Advanced tasks

Use pai --help --all for permanent setup, receipts, MCP and direct-key purchases. Preview configuration changes with pai setup --dry-run; restore backups with pai setup --restore. Export guest recovery with pai workspace export --file <path> only to a private destination. Recovery grants workspace management access.

Rules

Never print, log or repeat API keys, wallet secrets, management credentials or recovery files. pai keys show is for shell integration, not model context.
Use CLI commands to manage state; do not manually edit or delete its files.
Ask before payments the user has not requested. Existing task approval covers only the requested payment and amount.
Run permanent pai setup changes only when requested; otherwise preview with --dry-run.
Use a user's existing subscription agent when they request that workflow. Phantom inference and MPP payments require their intent.
Exit code 2 means a rejected key; report it rather than retrying unchanged credentials.

phantom-ai

Phantom AI

Connect and run