# Protect the wallet that pays for requests

Your wallet signs the payment authorization on your device. Onchain Router receives the authorization but never receives your seed phrase or wallet private key.

## Safe mainnet wallet policy

- Create a new account used only for Onchain Router.
- Hold only the USDC needed for the next few requests.
- Set a hard limit for each request in atomic USDC units. The local mainnet acceptance client uses
  `1000000`, which means `1.000000` USDC; the live server may enforce a lower limit independently.
- Set a separate session cap for autonomous use.
- Allow only Base mainnet (`eip155:8453`), official Base USDC, and the expected recipient.
- No operator registration is required. The server applies a per-request maximum and a global estimated-loss breaker. These server controls protect the service; they do not replace your local wallet limits.
- Disconnect or revoke site access when testing is complete.

## Before every signature

Read the `scheme`, `network`, `asset`, `payTo`, `maxAmountRequired`, and expiry fields from the live Hypertext Transfer Protocol (HTTP) 402 response. Reject the payment if the request body changed, the recipient is unexpected, the network is not Base mainnet, the asset is not official Base USDC, the quote expired, or the maximum exceeds your local limit.

Do not infer payment terms from this page. Runtime terms and the current public catalog are authoritative.

## Switching wallet accounts

In the repository's optional local acceptance UI, use **Change buyer**, select the new account in the wallet, and verify the complete address. The UI clears the old quote when the exposed account changes. Other x402 buyers must provide an equivalent account-change and quote-invalidation safeguard. Always preview again after switching.