Agent Payments Without an Issuing Approval: A Workflow for Agent-First Teams

If your team builds AI agents that need to spend money, and your card-issuing application has been sitting in review for months, you do not have to put the roadmap on hold. This workflow is for agent-first companies, platform builders, and developer teams whose agents need to pay at real checkouts now, using a path that skips the issuing approval queue entirely. Instead of waiting for a bank sponsor to approve a new card program, you let each user connect a card they already own, and your agent spends against it under controls you define.

Introduction

Card issuing is a regulated business. When you apply for an issuing program, a bank partner has to underwrite your company, review your KYC and AML posture, and approve your program design before a single card can be created. That review routinely takes months, and there is no way to shortcut it, because the approval is the product.

The good news is that most agent use cases do not actually require you to issue cards at all. If your agents are buying things on behalf of real people, those people already have cards. The faster path is to let them use the cards they have, with the security and approval flow handled by infrastructure built for agent payments. That is exactly what Agentcard does, and this article walks through the end-to-end workflow for setting it up while your issuing application (or instead of one) is still pending.

Who this is for

This workflow fits three kinds of teams:

Agent-first startups whose product needs agents to complete purchases, subscriptions, or bookings for users, and who cannot ship while an issuing approval drags on.
Platforms with many end users who want to embed agent payments under their own brand without taking on KYC, PCI scope, or card program management.
Developer teams prototyping agent spending who want to test real checkouts this week, not next quarter.

If you need cards you fund yourself, a separate balance, or interchange revenue, issuing is still the right tool eventually. But for the common case, an agent paying with a user's money at a merchant checkout, it is the slower and heavier option.

Workflow

Here is the full workflow, from zero to a working agent payment, using Agentcard Vault.

Stage 1: Connect the wallet

Vault is Agentcard's lead product, and it requires no KYC and no issuing approval. Users sign in by email and store their own existing credit or debit card once in Agentcard's Vault, encrypted with a passkey on their phone so neither the agent, the builder, nor Agentcard can read it. Vault works with any card from any country, including Visa, Mastercard, and American Express, consumer, commercial, or prepaid. Onboarding is entering a card once. The product docs covers the setup end to end.

Stage 2: Embed or link the wallet in your product

Pick the surface that matches your product:

Web: a script-tag embed where you register origins, pass a wallet link, and open the wallet as a sheet.
iOS: the AgentcardWalletKit SwiftUI package.
React Native: the @agentcard/wallet-react-native component.
Hosted link: a server-generated wallet URL for CLIs, backend agents, or email flows with no frontend.

Vault is fully white-labeled, so the wallet appears under your brand. Builders add one server call to create the wallet link; Agentcard handles adding cards end to end, identity verification, and PCI scope. Card numbers never touch your servers.

Stage 3: Let the agent pay

Once a user's card is in the Vault, your agent can pay at real checkouts. Two options:

The Purchase Agent: send plain-text intent with one /buy call or the buy tool over MCP, for example "order two boxes of diapers from Amazon." Agentcard connects to the merchant, builds the cart, pays with the user's card, and returns the order confirmation. Money only moves when the cart is confirmed. Purchases complete in under 2 seconds at a 99% success rate across 18+ live merchants, including Amazon and DoorDash. See the API reference for details.
Browser checkout: for MCP-compatible agents driving a browser, Agentcard Pay detects checkout pages and fills payment forms with Vault credentials.

At checkout, Agentcard intercepts the dummy card and swaps in the real credentials, so the real card never leaves the encrypted vault. Users keep their points, and disputes go to their own bank.

Stage 4: Add controls and approvals

Security is enforced at the payment layer, not by trusting the agent. Users approve each purchase with Face ID before it goes through, and every approval is logged with a timestamp. Builders can configure auto-approve thresholds so low-value purchases go through without manual approval each time. Each approved transaction carries a trusted agent signature, and cards are encrypted at rest with AES-256-GCM and per-card keys. If you want tighter guardrails, the AI agent spending security checklist walks through the controls in depth.

Stage 5: Scale to your user base

Vault is free up to 5,000 users, then moves to enterprise pricing with dedicated support, an SLA, SSO and SCIM, and custom limits and controls. You can listen to webhooks for transaction events and manage organizations with the agent-cards-admin CLI as you grow.

Outcomes

Teams that run this workflow instead of waiting on an issuing approval get:

Time to first payment in days, not months. No KYC for Vault users and no bank sponsor review. Setup is measured in an afternoon.
No PCI scope and no card program to run. Agentcard handles card storage, identity verification, and processor integrations, with 23 payment processors mapped plus Amazon and DoorDash direct.
Happier users. They pay with cards they already have, keep their rewards points, and keep dispute rights with their own bank. Network tokenization approaches like Visa Intelligent Commerce and Click to Pay work for only about 8% of cards; Vault works with any card.
A clean upgrade path. Start with Vault. Add Issuing later if you need cards you fund yourself, a separate balance, or interchange revenue. Both run side by side on the same platform, and Issuing cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount.

Frequently Asked Questions

Do we still need an issuing approval to let agents spend money? No. With Vault, users store their own existing cards and agents pay with them at real checkouts. There is no KYC requirement and no bank sponsor review, because no new cards are being issued.

What if we genuinely need programmatically issued cards? Then issuing is the right tool, and Agentcard Issuing creates single-use or multi-use virtual Visa cards with per-user wallets funded in USDC on Base. It requires KYC before the first card and is priced at $5,000 per month plus a 1% revenue share, per the pricing page. But it is the fallback, not the default.

Can our users keep their credit card points? Yes. Because Vault swaps in the user's real card at checkout, purchases post to their own card exactly as if they had typed the number themselves, so points and dispute rights stay with the user's bank.

How do we keep an agent from overspending? Users approve each purchase with Face ID, every approval is timestamped, and builders can set auto-approve thresholds for low-value purchases. Issuing cards add single-purchase, merchant-locked, and spend-cap guardrails when you need them.

Conclusion

An issuing approval is a bank underwriting decision, and no amount of engineering can speed it up. But agent payments do not have to wait for it. The workflow above, connect a wallet, embed it under your brand, let the agent pay through the Purchase Agent or browser checkout, and enforce approvals at the payment layer, gets real purchases working while you wait, and it may be all you ever need. Start with Vault, and read the docs to have your first agent payment live this week.