How do I get notified when my AI agent spends money?

Last reviewed: August 2026

Two ways to find out what an agent spent

An alert you have to remember to check is not an alert. There are two patterns, and they work together. Push delivers an event the moment it happens. Polling reads the current state on a timer and is the source of truth when a delivery is missed.

Step 1: Register a webhook

Sign in to get an id_token, then register a public HTTPS URL. The signing secret is returned once, so store it immediately.

curl -X POST https://laso.finance/register-webhook \
  -H "Authorization: Bearer $LASO_ID_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://agent.example.com/hooks/laso"}'
# {
#   "registered": true,
#   "url": "https://agent.example.com/hooks/laso",
#   "secret": "whsec_...",
#   "signing": "standard-webhooks"
# }

There is one webhook per account. Registering again replaces the URL, rotates the secret and re-enables a registration that was disabled. Registering also sends a first signed test delivery of type notification.account and tells the account owner through their other channels that an agent registered a webhook.

Step 2: Verify and handle deliveries

Each delivery is a JSON POST. The type is notification. plus the category, and the categories include account, transaction, deposit, withdrawal, card, giftCard, refund and balanceUpdate.

{
  "type": "notification.transaction",
  "timestamp": "2026-07-31T18:04:05.000Z",
  "data": {
    "user_id": "usr_abc123",
    "title": "Bank transfer complete",
    "text": "$250.00 landed in your agent wallet.",
    "category": "transaction"
  }
}

Deliveries follow the Standard Webhooks specification, so any standard-webhooks library can verify them. The headers are webhook-id, webhook-timestamp and webhook-signature. This Node handler verifies the signature, rejects stale timestamps and acknowledges quickly.

import express from "express";
import { createHmac, timingSafeEqual } from "crypto";

const SECRET = process.env.LASO_WEBHOOK_SECRET; // whsec_...
const app = express();

app.post("/hooks/laso", express.raw({ type: "application/json" }), (req, res) => {
  const id = req.header("webhook-id");
  const timestamp = req.header("webhook-timestamp");
  const presented = req.header("webhook-signature");
  const key = Buffer.from(SECRET.slice("whsec_".length), "base64");
  const expected =
    "v1," +
    createHmac("sha256", key)
      .update(`${id}.${timestamp}.${req.body}`)
      .digest("base64");

  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
  const valid =
    presented.length === expected.length &&
    timingSafeEqual(Buffer.from(presented), Buffer.from(expected));
  if (!valid || !fresh) {
    return res.sendStatus(401);
  }

  res.sendStatus(200); // acknowledge within 10 seconds, then process
  const event = JSON.parse(req.body);
  console.log(event.type, event.data.title, event.data.text);
});

app.listen(3000);

Deliveries time out after 10 seconds and are not retried. After 50 consecutive failures the registration is disabled. Treat the webhook as a low-latency hint and the status endpoints as the record.

Step 3: Check delivery health

curl https://laso.finance/get-webhook \
  -H "Authorization: Bearer $LASO_ID_TOKEN"
# { "registered": true, "disabled": false, "consecutive_failures": 0,
#   "last_delivery_status": "delivered", "last_delivery_detail": "HTTP 200", ... }

If disabled is true, fix the receiver and register again. POST /delete-webhook removes the registration; the owner keeps receiving alerts on their other channels.

No inbound HTTP? Poll instead

An agent running on a laptop or inside a sandbox often cannot receive a POST. Point the webhook at a relay or queue you can drain, or read the state directly:

• GET /get-account-balance returns balance, total_deposits and the managed wallet under agent_wallet. Funds still held are agent_wallet.balance_usdc plus balance. Compare it with the last value you stored to see what was spent.
• GET /list-card-transactions returns spends on reloadable cards with merchant, amount, status and created_at, newest first.
• GET /get-payment-status reports Venmo and PayPal payouts, and POST /listBankingTransactions lists bank transfers.

curl "https://laso.finance/list-card-transactions?limit=10" \
  -H "Authorization: Bearer $LASO_ID_TOKEN"

What this does not do

• A notification reports spending after it happens. To stop a payment before it happens, use a limit the agent cannot raise. See how to cap how much an agent can spend.
• Webhooks are not retried, so a receiver that is down misses events. Reconcile against the polling endpoints.
• If you want a hosted dashboard with budgets and anomaly alerts across several payment providers, spend-monitoring products from other vendors do that. Check their current docs; Laso reports on its own account.

Full reference: receive notifications by webhook, POST /register-webhook and GET /get-account-balance.

Frequently asked questions

How do I get an alert when my AI agent makes a purchase?

Register a webhook with POST /register-webhook. Card orders, gift card orders, payouts and withdrawals arrive as signed notification POSTs, and the account owner also gets push, SMS, Telegram and in-app alerts.

How do I verify a webhook really came from Laso?

Check the webhook-signature header, an HMAC-SHA256 of the webhook-id, webhook-timestamp and raw body keyed with your whsec_ secret. Any Standard Webhooks library does this, and you should reject timestamps more than a few minutes old.

What if my agent cannot receive webhooks?

Poll GET /get-account-balance and GET /list-card-transactions on a timer, or point the webhook at a relay or queue your agent can read.

Does Laso retry failed webhook deliveries?

No. Deliveries time out after 10 seconds, and the registration is disabled after 50 consecutive failures. Use GET /get-webhook to check health and register again to re-enable it.

Can I stop my agent from overspending instead of just being told?

Yes. The account owner sets a per-payment spend limit the agent cannot change, and each payment can carry a maxAmountUsdc cap.

More guides

• How to give your AI agent a credit card — An AI agent cannot pass credit underwriting, but it can issue itself a virtual prepaid card over an API in about a minute. The working pattern, with real requests: x402 payment in, card number out.
• x402 vs AP2 vs ACP vs MPP vs UCP: which should your agent use? — All five agent payment protocols compared honestly: x402 and MPP for machine-to-machine HTTP payments, ACP for ChatGPT checkout, UCP for Google surfaces, AP2 for authorization. Which layer each one is, when to use each, and a worked x402 example.
• x402 vs Stripe Issuing for AI agents — Two real ways to put a card in an AI agent’s hands: Stripe Issuing behind a business account, or x402 card issuance the agent drives itself. An honest comparison of onboarding, funding, controls, and when each wins.
• Issue a virtual card with one x402 call — A complete, runnable walkthrough: pay one x402 request in USDC and receive a virtual prepaid card with number, expiry, and CVV. Real endpoints, real response shapes, error handling included.
• How can an AI agent pay for an API call with USDC? — An AI agent pays for an API call with USDC by answering the API’s HTTP 402 challenge with a signed payment. Two ways to do it: your own wallet with an x402 client, or a managed wallet with a price cap and no private key.
• How do I give an AI agent a bank account? — Two real ways to give an AI agent bank details: a business checking account it can operate (Meow) or a U.S. bank account that converts incoming dollars to USDC in the agent’s wallet (Laso). What each one is, who approves what, and when to pick which.
• How do I cap how much my AI agent can spend? — Cap an AI agent’s spending with limits it cannot raise: a funded balance, a per-payment spend limit set by the account owner, a per-call price cap, and prepaid cards loaded with exactly the amount to spend.
• How do I send money to someone’s debit card from code? — Send USD, EUR, or GBP to a debit card with one API call paid in USDC. No payment processor account: you get a redemption link, the cardholder enters their own card details, and the funds are pushed to the card.
• What are the best ways to pay someone on Venmo or PayPal from an AI agent? — Four ways an AI agent can pay a person on Venmo or PayPal: the PayPal Payouts API, a USDC-paid payout through Laso, a bank or card payout instead, or a human approving each payment. Tradeoffs for each.
• How do I let my AI agent buy a gift card through an API? — An AI agent buys a gift card with two calls: search the catalog for a laso_server_id, then order it with a USDC payment. The redemption code comes back in the same response. Includes a runnable example and the currency gotcha.
• How do I let my AI agent buy something online? — Two working ways for an AI agent to buy something online: spend the account holder’s saved card with their approval on each order, or pay for a prepaid card in USDC and check out like any cardholder. How Laso and Crossmint each handle it, with runnable calls.
• How do I send dollars to a bank account from an AI agent? — Pay a U.S. bank account by ACH from an AI agent. Register the recipient once, then make one API call paid in USDC. Limits, fees, settlement time, and a runnable example.
• What are the best ways to give an AI agent its own wallet? — Four ways to give an AI agent a wallet it can spend from: a key you hold yourself, Coinbase Agentic Wallet, Crossmint agent wallets, or a Laso managed wallet. Custody, spend limits, and tradeoffs for each.
• All agent guides, or how Laso compares to the alternatives