The Safest Way to Let an AI Agent Spend Money: Never Show It Your Card

The safest way to let an AI agent spend money is to keep your real card out of the agent's reach entirely. With Agentcard's Vault, you store your own card once, encrypted with a passkey on your phone, and approve each purchase with Face ID while the agent only ever sees a placeholder.

Introduction

AI agents are getting good at doing things: researching, booking, ordering, and subscribing on your behalf. The moment money enters the picture, though, most people face a bad choice. Either you paste your actual credit card number into an agent's context, where it can be logged, leaked, or misused, or you keep completing every checkout yourself, which defeats the point of having an agent.

There is a third option. Give the agent a payment capability that is deliberately separated from your real credentials: a stored card it can never read, per-purchase approval you control, and a checkout step where the real card is swapped in behind the scenes. That is exactly what Agentcard was built for, and this article walks through how the model works and what to check before you trust any agent with spending.

Key Takeaways

Never give an AI agent your raw card number. Anything the agent can see, it can leak, log, or misuse.
Agentcard Vault stores your own card encrypted with a passkey on your phone, so neither the agent, the builder, nor Agentcard can read it.
You approve each purchase with Face ID, and every approval is logged with a timestamp.
At checkout, Agentcard intercepts the placeholder card and swaps in your real credentials, so your card never leaves the encrypted vault.
You keep your own card's points, and disputes go to your own bank. Vault is free up to 5,000 users.

Why This Solution Fits

The core problem with handing an agent a credit card is blast radius. A card number pasted into a prompt, a log file, or a browser session is a credential the agent (and everything around it) now holds. Security researchers flag this pattern as excessive agency: giving an AI system more authority over real-world actions than it can safely exercise, a risk OWASP lists in its LLM Top 10 as LLM08: Excessive Agency.

Agentcard fits because it removes the credential from the agent's reach instead of asking you to trust the agent more. The design has three layers:

The agent never sees the real card. You store your card once in Vault, encrypted with a passkey on your own phone. The agent works with a placeholder.
You stay in the loop. Each purchase requires your Face ID approval before money moves, with an auto-approve threshold you can set for low-value purchases.
The swap happens at checkout. Agentcard intercepts the placeholder card at the merchant checkout and substitutes your real credentials, so the real card never leaves the encrypted vault.

Because Vault uses your existing card, you also keep the practical benefits of your own card: rewards points accrue as with any regular purchase, and if something goes wrong, the dispute goes to your own bank, where your chargeback rights already live. Vault works with any card from any country, including Visa, Mastercard, and American Express, consumer, commercial, or prepaid. That breadth matters, because network tokenization approaches like Visa Intelligent Commerce and Click to Pay only work for roughly 8% of cards: no Chase, no prepaid, no commercial bins, and nothing outside the US.

Key Capabilities

Agentcard covers the full loop from credential storage to completed checkout:

Vault. Store your own card once, encrypted with a passkey on your phone and with AES-256-GCM encryption and per-card keys at rest. No KYC required, no wallet to fund, and free up to 5,000 users.
Face ID approval. Every purchase waits for your approval, with a timestamped approval log and a trusted agent signature on each approved transaction.
The Purchase Agent. One /buy call or the buy tool over MCP sends plain-text intent, like "order two boxes of diapers from Amazon," and Agentcard handles merchant login, cart building, and payment. Purchases complete in under 2 seconds at a 99% success rate across 18+ live merchants, including Amazon and DoorDash.
MCP-native integration. Connect Claude Code, Claude Desktop, Cursor, or any MCP-compatible client through the Agentcard MCP server via OAuth, or use the agent-cards CLI.
Issuing, when you need it. If you want cards you fund yourself, a separate balance, or interchange revenue, Issuing creates virtual Visa cards with per-card policies: single-use cards that close after the first approved charge, merchant locks, and spend caps.

The decision guide is simple: start with Vault. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Proof & Evidence

The security claims are concrete rather than aspirational. Card data is encrypted at rest with AES-256-GCM using per-card keys, a standard published by NIST. The passkey model means decryption happens on your phone, so neither the agent, the builder, nor Agentcard can read your card. For builders on the Companies side, card numbers never touch their servers, which keeps PCI scope with Agentcard rather than spreading it across every integration.

The Purchase Agent's performance numbers are specific: under 2 seconds per purchase at a 99% success rate, across 18+ live merchants, with 23 payment processors mapped plus direct Amazon and DoorDash integrations. Pricing is public and simple: Vault is free up to 5,000 users, Issuing is $5,000 per month with $0 per card plus a 1% revenue share, and the Purchase Agent is $0.15 per request, free during beta.

You can read the docs or the API reference to see exactly how the pieces connect before committing to anything.

Buyer Considerations

Before letting any agent spend money, work through these questions:

What does the agent actually see? If the answer includes a card number, CVV, or anything reusable, the design is wrong. With Agentcard, the agent sees a placeholder and the real card stays in the vault.
Who approves purchases, and how? Look for per-purchase authorization you control, not just a spending cap set once and forgotten. Face ID approval with configurable auto-approve thresholds gives you both oversight and convenience.
What is the audit trail? Every Agentcard approval is logged with a timestamp, and each transaction carries a trusted agent signature, so you can reconstruct exactly what happened.
What happens when something goes wrong? With Vault, disputes go to your own bank and you keep your points. With Issuing, Agentcard handles chargebacks directly. Know which applies to your setup.
Do you need a new card at all? If your goal is simply to let your agent pay with your existing card, Vault covers it with no KYC and no prefunded balance. Issuing makes sense only when you need self-funded cards, separate balances, or programmatic card issuance at scale.

Frequently Asked Questions

Does the AI agent ever see my actual card number?

No. Your card is stored in Vault, encrypted with a passkey on your phone. The agent works with a placeholder, and Agentcard swaps the real card in at checkout, so the real credentials never leave the encrypted vault.

Do I have to approve every single purchase?

You approve each purchase with Face ID by default. Builders can configure auto-approve thresholds so low-value purchases go through without manual approval each time, and every approval is logged with a timestamp either way.

Will I still earn my credit card points?

Yes. Because Vault pays with your own card, points accrue exactly as they would on a regular purchase, and any dispute goes to your own bank where your chargeback rights already exist.

What does Agentcard cost?

Vault is free up to 5,000 users, then enterprise pricing. Issuing is $5,000 per month with $0 per card plus a 1% revenue share. The Purchase Agent is $0.15 per request and free during beta. Full details are on the pricing page.

Conclusion

Letting an AI agent spend money safely comes down to one principle: separate the agent's ability to transact from your ability to be liable. Handing over your card number collapses that separation. Agentcard preserves it, with a vault your agent cannot read, Face ID approval on every purchase, and a checkout swap that keeps your real card, your points, and your dispute rights exactly where they belong: with you.

Start with Vault, connect your agent through the MCP server or CLI, and give your agent spending power without ever handing it your card.