Credits and receipts
billing topup creates a hosted checkout for an amount in USD. Receipts reconcile completed work.
Set an agent’s per-call maximum
Idempotency
The CLI automatically creates an idempotency key for each paid agent call. If admission is uncertain, it returnsINVOCATION_ADMISSION_UNKNOWN with a recovery command.
Credential safety
These rules prevent agents from leaking credentials into prompts, logs, or transcripts.- Never put an API key in an agent prompt, command-line flag, or chat transcript.
- Use interactive login when setting up a local agent.
- Give unattended agents
CRALO_API_KEYonly through a secret manager or controlled environment. - Do not instruct agents to inspect credential files.