We Built Stripe Projects Before the Spec Opened

In April, Cloudflare and Stripe announced Stripe Projects, a new standard that lets autonomous AI agents discover, provision, and pay for cloud services on their own. No human in the loop. No copy-pasted API keys.

There is a catch. The wire protocol is closed. Partner access requires Stripe Partner Directory acceptance and Cloudflare Agentic Partnerships clearance. For most teams, the message is "wait six months."

We did not wait. We shipped the entire developer-facing product on day one.

What Stripe Projects actually is

Strip away the announcement language and the standard does three things.

It defines a container for agent spend, called a project. The project owns a payment method, a monthly cap, and a list of provisioned services. It defines a catalog: Cloudflare, AWS, Vercel, and any provider Stripe lists become discoverable to the agent. It defines a broker: Stripe handles the OAuth dance, credential issuance, and provider-side billing.

For developers, the value is obvious. Your agent needs an R2 bucket, a domain, a Vercel function. It picks one from the catalog, the project pays, the credentials drop in. No human approval loop.

What the protocol does not solve

A closed payment protocol does not answer the questions that decide whether an agent gets to spend at all.

Who is the agent? What is its compliance status? Did the spending policy approve this transaction? What was the audit trail? When the agent goes off the rails at 3 AM and tries to provision a thousand domains, what stops it?

These questions are not Stripe's job. They are not Cloudflare's job. They are the orchestration layer's job. Without that layer, agent provisioning becomes a liability.

What we built

Oris is the orchestration layer. KYA identity verification, programmable spending policies, multi-rail compliance, audit trails, atomic cap reservations. The infrastructure that turns "the agent can pay" into "the agent should pay."

When Stripe Projects landed, we asked one question. Can we ship the developer experience right now and let the protocol catch up?

Six weeks later the answer is yes. We shipped:

• Project containers with monthly caps, payment methods, and provider-scoped services
• Service catalog with Cloudflare integrations live, AWS and Vercel queued
• Provisioning saga backed by Stripe customer, setup intent, and payment intent flows. Idempotent and atomic
• Eighth policy evaluator dedicated to project caps, sub-10ms decisions
• Encrypted credential vault with envelope encryption and Vault Transit DEKs
• HMAC-signed env-pull endpoint so leaked credentials are detectable

Quick start

from oris import Agent

agent = Agent.from_env()

# Provision a Cloudflare R2 bucket through Oris.
# KYA + policy + cap + audit + encrypted credentials, in one call.
service = agent.projects.add_service(
    project_id="proj_abc123",
    provider="cloudflare",
    service="r2",
    qualifier="bucket:agent-storage",
)

env = agent.projects.env_pull("proj_abc123")
# env.vars contains the scoped credentials.
# env.signature is HMAC-SHA-256, valid for 60 seconds.

The architectural promise

Stripe Projects will eventually open. When it does, we will not rewrite a single line of consumer code.

Inside Oris, the entire integration sits behind feature flags. Three swap points dispatch between today's public-API implementation and tomorrow's native protocol. The catalog source can switch from local seeds to Stripe-fetched. The provider handler can collapse from per-provider OAuth flows to a single Stripe-brokered handler. The payment adapter can route through a Stripe Customer or directly through Shared Payment Token.

The day Stripe accepts our partnership application, three stub files get filled in. Saga compensation, idempotency locks, audit rows, RLS, KYA gates, and policy decisions all keep working. Public API surface stays identical. Developers experience zero migration.

Six phases, one sprint

Phase 6 is what shipped this week. The first five phases shipped the developer experience. Phase 6 ships the day Stripe opens up.

Why this position matters

Every payment standard goes through three phases. Closed announcement. Gated rollout. Public availability. Oris is positioned to ship across all three.

Today, in the gated rollout phase, we ship Stripe Projects-equivalent semantics over public Stripe primitives. Developers get the developer experience now. They build agent payment flows against an API that will not change.

Tomorrow, when the spec opens, we flip a flag. Same code, native protocol underneath.

Compliance, identity, policy, and audit are Oris. Service rails are pluggable. Stripe Projects becomes one of many rails alongside ACP, MPP, Stripe Issuing, and the on-chain stablecoin path that already runs in production.

By the numbers

Where to see it

Money 2020 Europe runs June 2 to 4 in Amsterdam. We will be there with the Stripe Projects integration live, agents provisioning real services on stage, the full compliance trail behind every transaction.

If you build agent infrastructure, the SDK is on PyPI. pip install oris-sdk. The TypeScript version is on npm. The LangChain and CrewAI integrations ship 25 tools each. The MCP server runs in Claude Desktop today.

The protocol catches up to the product. Not the other way around.