# Skill: give your AI agent a Wise wallet

*Free, from STEPTEN.IO. Drop this into Claude Code, Cursor, or any agent that reads skills. It teaches your agent to use the Wise API safely — check money, reconcile, and RAISE transfers for your approval, without ever letting it send money on its own. Written by someone who ran a real BPO's payments through it.*

## The one rule
**Read-and-raise, never auto-approve.** An agent can watch the money and draft the transfer. A human approves the send. Every time. Everything below enforces that.

## 1. Get a token
In your Wise **business** account → Settings → API tokens, generate a **personal API token**. For an agent, start with a read-scoped token (balances + statements). Only add money-movement scope once the approval flow below is in place.

- Base URL (live): `https://api.wise.com`
- Auth header: `Authorization: Bearer <token>`
- Store the token in a **vault**, never in code or `.env` plaintext.

## 2. What the agent reads (safe, read-only)
- `GET /v1/profiles` — find your profile id (watch for the wrong-business trap: if you have more than one profile, pin the right `id` explicitly. Ask me how I know).
- `GET /v4/profiles/{profileId}/balances?types=STANDARD` — current balances per currency.
- `GET /v1/profiles/{profileId}/balance-statements/{balanceId}/statement.json?...` — transactions in/out for reconciliation. Match these against your accounting (Xero, etc.).

## 3. Raise a transfer FOR APPROVAL (the whole workflow)
The agent builds the transfer but stops before funding. You approve in the Wise UI.
1. `POST /v3/profiles/{profileId}/quotes` — create a quote (source currency, target currency, amount).
2. `POST /v1/accounts` — create/select the recipient.
3. `POST /v1/transfers` — create the transfer referencing the quote + recipient. **Stop here.** The transfer exists as unfunded — you review and fund/approve it yourself.

## 4. The safety gate (why an agent can't drain you)
Actually **funding** a transfer triggers **Strong Customer Authentication (SCA)**: the API returns `HTTP 403` with a one-time challenge token in a header. To proceed, your code must sign that challenge with a **private RSA key** (SHA-256) and resubmit. Keep that signing key **out of the agent's reach** — in a vault, released only for a human-approved action. No key, no send. That's the wall.

- Funding via API is **country-limited**. Supported at time of writing: business accounts in Singapore, US, Canada, Australia, New Zealand, Malaysia. Check yours.

## 5. Good jobs to give the agent
- Daily "money in / money out" summary from statements.
- Reconcile incoming payments against open invoices.
- Draft recurring payouts for your one-click approval.
- Track expenses / card spend (Wise card API) for budgeting.

## 6. Do NOT
- Let the agent hold the RSA signing key or auto-fund transfers.
- Store the token or key in plaintext, a repo, or a chat.
- Trust a single profile lookup blindly — pin the profile id.

## The safe shape
`agent (read token) → sees money, drafts transfer → human approves in UI / signs SCA → money moves`

---

*Wise has a referral program. If this helped and you're signing up anyway, using a referral link supports the people who write free skills like this one. — STEPTEN.IO, the Rated desk.*