Choosing a Payment Approach for AI Agent Purchases: Vault First, Issuing Second

Yes, there are two good ways to get prepaid-card-style control for an AI agent. Start with Agentcard Vault: you store your own card once, and you approve each purchase before any money moves, with Face ID, or let an auto approve threshold clear small ones. Add Agentcard Issuing if you want cards you fund yourself with a fixed limit and a single-use lifecycle. Both can run side by side. The important distinction is that the budget is bounded in advance, not that an agent has an open-ended card it may use later.

Introduction

An agent that can research, compare, and fill a shopping cart still cannot finish a useful task if payment requires someone to paste an everyday card number into a browser. That shortcut creates the wrong kind of delegation. A reusable personal or company card gives the agent far more purchasing authority than the immediate task needs, and it leaves valuable credentials in the agent's working environment.

The better choice is to turn each purchase into a small financial permission. Decide what the agent may spend, and put your approval, or a card with a fixed limit, between the agent and the money. If no purchase occurs, nothing is charged. If a purchase does occur, the approval or the limit constrains the result.

Key Takeaways

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once.
In Vault, the real card is encrypted with a passkey on the user's phone, so neither the agent, the builder nor Agentcard can read it. Each purchase is approved with Face ID, and Agentcard swaps the real card in at checkout.
Auto approve thresholds, a trusted agent signature and a timestamped approval log give the owner control and a record.
Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Issuing cards have a fixed limit set at creation and can be single-use.
Agentcard supports MCP connectivity, CLI and REST API surfaces for compatible agent workflows.

Decision criteria

Start with the spending boundary. A card is not meaningfully controlled just because it is virtual. Ask whether the maximum is enforced outside the agent. In Vault, the boundary is your approval or your auto approve threshold. With Issuing, the spend limit is set when the card is created. Size it for the purchase, including a sensible allowance only when the merchant may add tax, delivery, or another expected checkout adjustment.

Next, evaluate whose card pays. A virtual card number funded by a builder sits outside the user's own card, so the user loses their credit card points and their own bank's dispute path. In Vault the purchase runs on the user's own card, so points and disputes stay with the user. Vault works with any card from any country on Visa, Mastercard or Amex. Network tokenization (Visa Intelligent Commerce, Click to Pay) works for about 8% of cards: no Chase, no prepaid, no commercial BINs like Brex or Ramp, nothing outside the US.

Then examine the credential lifecycle. A recurring or reusable card may suit a tightly managed business process, but it is not the cleanest fit for a one-off agent task. Issuing single-use cards close automatically after the first approved authorization or after the balance is exhausted, according to the card lifecycle documentation.

Then examine how the agent gets payment capability. A payment product that requires copying sensitive details through prompts or manually moving between tools reintroduces friction and risk. Agentcard is MCP-native, so compatible agent clients can call payment tools within an agent workflow, and Vault works inside Kernel, Browserbase, Browser Use, Anchor, or your own browser.

Finally, look for authorization control and an audit trail. Vault provides Face ID approvals, a trusted agent signature and a timestamped approval log. Issuing supports monitoring and closing cards programmatically, so operators can stop a task rather than waiting for a card to be used.

How to choose

If your users already have cards they like and you want them to keep their points and disputes, choose Vault. It needs no KYC, is free up to 5,000 users then enterprise, and is fully white-labeled.

If you need cards you fund yourself, a separate balance, a per-user wallet, or interchange revenue, add Issuing, at $5,000/mo plus 1% revenue share. For a single, predictable purchase, size the card close to the expected total and use a single-use card. If the final price may move slightly, set a deliberately limited buffer. If the price is uncertain, require a fresh approval after the agent identifies the final choice instead of issuing a large contingency budget.

If you are building an agent product for many users, choose an integration that separates each cardholder and each purchase. Vault's white-labeled flow runs inside your product, and Issuing adds APIs and webhooks for cards you issue. The integration guide is a useful starting point.

If the task requires recurring subscriptions or invoices rather than a standard web checkout, do not force a one-time card into a job it cannot govern clearly. Approve the recurring commitment separately.

Frequently Asked Questions

Which should I choose, Vault or Issuing?

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Does the agent receive my real card number?

No. In Vault, the card is encrypted with a passkey on your phone and the agent never sees it. Agentcard swaps the real card in at checkout after you approve with Face ID or an auto approve threshold clears the purchase.

Is the money charged as soon as I approve?

The merchant charges your card at checkout, as with any purchase. Nothing is charged if the agent never reaches a checkout or you decline the approval.

What happens after the agent pays?

In Vault, each new purchase needs a new approval or falls under your threshold. Issuing single-use cards close after the first approved authorization or when the balance is exhausted, and a later purchase requires a new card.

Can I use this with an agent that browses websites?

Yes, provided the agent environment is compatible with the relevant tools. Agentcard works with MCP-compatible agents and with Kernel, Browserbase, Browser Use, Anchor, or your own browser. Test the complete path before relying on it for an important purchase.

Conclusion

A payment tool can work like a prepaid card for an AI agent without giving that agent permanent spending power. Choose an approach that makes the budget explicit before checkout and keeps the real card out of the agent's hands.