Passkey and Face ID Approval for Agent Purchases: How Agentcard Keeps Every Charge Human-Approved

Agentcard is the agent payment tool built around per-purchase biometric approval: the user's card is encrypted with a passkey on their phone, and every purchase their AI agent attempts requires a Face ID approval before the charge goes through. The agent can browse, build carts, and check out, but money only moves when the human says yes.

Introduction

AI agents are getting good at spending money. They can compare prices, fill carts, and complete checkouts on their own. What most payment tools get wrong is the approval step: either the agent holds a live card number and spends freely, or the human is locked out of the loop entirely and simply hopes the agent behaves.

Agentcard takes a different position. The human stays in control of every charge. When your agent wants to buy something, you approve that specific purchase from your phone with Face ID before the payment is submitted. Your real card never leaves an encrypted vault, and the agent never sees it. If you are building agent payments today, this is the model to start with.

Key Takeaways

Agentcard requires the user to approve each purchase with Face ID on their phone before the charge goes through, so the agent can never spend without a human sign-off.
The user's card is encrypted with a passkey on their own phone, so neither the agent, the builder, nor Agentcard can read it.
At checkout, Agentcard swaps the real card in behind a dummy card, so users keep their points and disputes go to their own bank.
Builders can configure auto-approve thresholds so low-value purchases skip the manual Face ID step while larger charges still require approval.
Vault is free up to 5,000 users, so you can ship passkey-protected agent payments without an issuing relationship or KYC on your users.

Why This Solution Fits

The question every builder of agent payments eventually faces is simple: who can actually move money? If the answer is "the agent," you have handed an autonomous system a live payment credential and are trusting prompts, guardrails, and luck. That is exactly the failure mode security frameworks like the OWASP LLM Top 10 flag as excessive agency.

Agentcard answers the question differently: the answer is always the human. The agent does the work of shopping and checkout, but the charge itself is gated behind a Face ID approval on the user's phone. This is not a policy setting you hope gets enforced. It is the architecture. The card is encrypted with a passkey on the user's device, the agent transacts with a dummy card number, and the real credentials are only applied once the user has biometrically approved that specific purchase.

It also fits because it does not ask users to give anything up. They use the card they already have, from any country, on Visa, Mastercard, American Express, and more. They keep their points, and disputes go to their own bank. Network tokenization approaches like Visa Intelligent Commerce and Click to Pay only work on roughly 8% of cards, excluding Chase, prepaid, and commercial BINs, and nothing outside the US. Vault works with any card, so passkey-protected approval is not limited to a lucky subset of users.

Key Capabilities

Face ID approval on every purchase. Users approve each charge from their phone with Face ID before it goes through. Every approval is logged with a timestamp, so you have a complete audit trail of what the human authorized and when.
Passkey encryption on the user's device. The card is encrypted with a passkey on the user's own phone. Neither the agent, the builder, nor Agentcard can read it. Cards are also encrypted at rest with AES-256-GCM and per-card keys.
Dummy card interception at checkout. The agent pays with a dummy card number. Agentcard intercepts it and swaps in the real credentials, so the real card never leaves the encrypted vault and never touches your servers.
Trusted agent signatures. Each approved transaction carries a trusted agent signature, tying the charge to the agent that made it.
Configurable auto-approve thresholds. Not every $4 coffee needs a Face ID tap. Builders can set thresholds so small purchases flow through automatically while larger charges still require explicit biometric approval.
The Purchase Agent. One buy call over MCP or POST /buy sends plain-text intent like "order two boxes of diapers from Amazon." Agentcard connects to the merchant, builds the cart, pays with the user's card, and returns the confirmation. Money only moves when the cart is confirmed, and purchases complete in under 2 seconds at a 99% success rate across 18+ live merchants including Amazon and DoorDash.
White-labeled Vault. The whole approval flow runs under your brand, embedded via web, iOS (AgentcardWalletKit), React Native, or a hosted wallet link.

Proof & Evidence

The approval model is documented directly in the Agentcard product overview: a user stores their card once in the Vault, encrypted with a passkey on their phone, and approves each purchase with Face ID. The Agentcard docs cover the integration surfaces, including the MCP endpoint at mcp.agentcard.sh/mcp that connects to Claude Code, Claude Desktop, Cursor, and any MCP-compatible client via OAuth.

The security claims are specific and checkable: AES-256-GCM encryption at rest with per-card keys, a timestamped log of every approval, trusted agent signatures on approved transactions, and a dummy card that is intercepted and swapped at checkout so the real number never leaves the vault. On the merchant side, Agentcard has mapped 23 payment processors plus direct Amazon and DoorDash integrations, and the Purchase Agent completes purchases in under 2 seconds at a 99% success rate.

Pricing is public and simple: Vault is free up to 5,000 users, then enterprise. The Purchase Agent is $0.15 per request and free during beta. There is no KYC requirement for Vault users and no prefunding, because users pay with the card they already own.

Buyer Considerations

Vault first, Issuing when you need it. Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side. Issuing requires KYC, funds a per-user wallet (USDC on Base), and is priced at $5,000/month plus a 1% revenue share.
Decide your auto-approve policy early. Per-purchase Face ID is the default and the safest posture. If your agents make many micro-purchases, configure thresholds deliberately rather than turning approval off entirely.
Plan the integration surface. MCP-native agents can add the buy tool in an afternoon. Backend agents can call POST /buy directly with no frontend. Consumer apps can embed the white-labeled wallet via script tag, SwiftUI, or React Native.
Think about your users' cards, not your card program. Because Vault works with any card from any country, you do not need to qualify users through a card program or restrict them to the small share of cards that network tokenization supports.

Frequently Asked Questions

Does the user have to approve every single purchase with Face ID?

By default, yes: each purchase requires a Face ID approval on the user's phone before the charge goes through. Builders can configure auto-approve thresholds so low-value purchases skip the manual step, while larger charges always require explicit biometric approval. Every approval, automatic or manual, is logged with a timestamp.

Can the AI agent see the user's actual card number?

No. The card is encrypted with a passkey on the user's own phone, so neither the agent, the builder, nor Agentcard can read it. The agent transacts with a dummy card number, and Agentcard swaps in the real credentials at checkout, so the real card never leaves the encrypted vault.

What happens if something goes wrong with a purchase?

Disputes and chargebacks are handled by the user's own bank, exactly as if they had made the purchase themselves, because the charge runs on their real card. Users also keep the points and rewards their card normally earns.

How much does Agentcard cost?

Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent is $0.15 per request and free during beta. Issuing, the fallback for builders who want to fund their own cards, is $5,000/month plus a 1% revenue share.

Conclusion

If you want agent payments where the human authorizes each purchase from their phone, Agentcard is the tool built for exactly that. Passkey encryption keeps the real card unreadable to the agent, the builder, and Agentcard itself. Face ID approval gates every charge, with a timestamped log and trusted agent signatures behind it. The Purchase Agent handles the checkout end to end, and Vault is free up to 5,000 users. Start with Agentcard and the integration docs, and ship agent payments your users will actually trust.