From Prompt to Purchase: The Card Issuing Workflow Agent-First Startups Ship Without a Sales Cycle

Agent-first startups that need their AI agents to pay at real checkouts, without a months-long enterprise sales process, can set up Agentcard in an afternoon: start with Vault so users pay with their own cards, add Issuing only when you need cards you fund yourself, and wire up the Purchase Agent so a plain-text intent becomes a completed order.

Introduction

The pattern is familiar. An agent-first startup gets real users, those users ask the agent to actually buy things, and the team discovers that payments are the hard part. Traditional card issuing platforms are built for enterprise buyers: procurement reviews, KYC programs, custom pricing calls, and weeks of integration work before the first transaction.

That sales process is exactly what agent-first teams do not have time for. The good news is that the modern stack looks different. Agentcard was built for this workflow from the start: an MCP-native payment rail where a user stores their card once, approves purchases with Face ID, and the agent pays at real checkouts. Setup is self-serve, and the whole flow can be live in an afternoon.

Who this is for

This workflow is for AI developers and agentic system builders who need secure payment infrastructure for agents that interact with real-world commerce. It fits teams building agents on Claude Code, Cursor, Claude Desktop, or any MCP-compatible client, as well as platforms that need to issue scoped cards to many end users' agents programmatically.

It is also the right fit if any of these describe you:

You want agents to complete purchases without users sharing real card details with AI systems.
You want to avoid building custom payment plumbing for every merchant.
You need API, CLI, MCP, and SDK surfaces that support agent workflows, with card numbers never touching your servers so PCI scope stays with Agentcard.
You want to ship this week, not after a procurement cycle.

Workflow

Stage 1: Start with Vault, not a sales call

The decision guide is simple: start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Vault is free up to 5,000 users and fully white-labeled, so you can embed it under your own brand from day one. Users can add any card from any country, on Visa, Mastercard, or American Express, consumer, commercial, or prepaid. That matters because network tokenization approaches like Visa Intelligent Commerce and Click to Pay work for only about 8% of cards: no Chase, no prepaid, no commercial BINs, and nothing outside the US. Vault works with any card.

Stage 2: Connect your agent over MCP or the API

Agentcard is MCP-native. Point your MCP-compatible client at the public endpoint and connect via OAuth. Tools cover card creation, card details, balance checks, card closure, transactions, and the buy purchase tool. If you prefer a terminal, the agent-cards CLI manages everything for personal users, and agent-cards-admin handles organizations.

For platforms integrating programmatically, the REST API uses organization-scoped Bearer API keys with JSON responses, plus cardholders and webhooks. Card numbers never touch your servers, so PCI scope stays with Agentcard. The integration guide and quickstart walk through the whole setup, and there are SDKs for web (script-tag embed), iOS (AgentcardWalletKit), and React Native, plus a hosted wallet link for CLIs, backend agents, or email flows with no frontend at all.

Stage 3: Let the Purchase Agent run the checkout

This is where the workflow gets interesting. Instead of building merchant integrations yourself, one /buy call or the buy tool over MCP sends plain-text intent, for example "order two boxes of diapers from Amazon." Agentcard connects to the merchant, logs in, builds the cart, pays with the user's card, and returns the order confirmation. Money only moves when the cart is confirmed.

Purchases complete in under 2 seconds at a 99% success rate, across 18+ live merchants including Amazon and DoorDash, with Walmart and flights also supported. Agentcard has mapped 23 payment processors plus direct Amazon and DoorDash integrations, so you do not maintain any of that plumbing. Pricing is $0.15 per request, free during beta.

Stage 4: Keep humans in control

Every purchase carries security controls by default. The user's card is encrypted with a passkey on their own phone, so neither the agent, the builder, nor Agentcard can read it, with AES-256-GCM encryption and per-card keys at rest. Users approve each purchase with Face ID before it goes through, and every approval is logged with a timestamp. At checkout, Agentcard intercepts the dummy card and swaps in the real credentials, so the real card never leaves the encrypted vault, and each approved transaction carries a trusted agent signature.

Builders can configure auto-approve thresholds so low-value purchases go through without manual Face ID each time, and set hard spending limits per task. If you issue cards through Issuing, cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount, and a single-use card lifecycle means a leaked card number is usable at most once.

Outcomes

Teams that run this workflow get:

Live in an afternoon. No sales cycle, no procurement, no KYC for Vault users. Onboarding is a user entering a card once.
Real checkouts, not toy demos. The Purchase Agent completes orders at Amazon, DoorDash, Walmart, and 15+ other merchants in under 2 seconds.
Users who keep their rewards. Because Vault swaps the user's real card in at checkout, users keep their points and disputes go to their own bank.
Contained risk. Passkey encryption, Face ID approval, timestamped logs, and single-use card lifecycles keep the blast radius small.
Your brand, not ours. Vault is fully white-labeled, so the wallet lives inside your product.
Pricing that starts at zero. Vault is free up to 5,000 users, and the Purchase Agent is free during beta.

Frequently Asked Questions

Do we need to go through a sales process to get started? No. Vault is self-serve and free up to 5,000 users. You can connect an MCP client or call the REST API today and be processing real purchases the same day. Enterprise plans with dedicated support, SLA, SSO and SCIM exist when you need them, but they are not a prerequisite.

When would we choose Issuing instead of Vault? Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Issuing creates new virtual Visa cards, single-use or multi-use, funded from a per-user USDC wallet on Base, and requires KYC before the first card. It runs $5,000/month plus a 1% revenue share. Both Vault and Issuing can run side by side.

Does the agent ever see the user's real card number? No. The card is encrypted with a passkey on the user's phone, and neither the agent, the builder, nor Agentcard can read it. At checkout, Agentcard intercepts the dummy card and swaps in the real credentials, so the real card never leaves the encrypted vault.

What do we have to build ourselves? Very little. You build one server call to create a wallet link, open the wallet in your product, listen to webhooks, and call buy. Agentcard handles adding cards end to end, identity verification, card issuing and PCI scope, and merchant login and checkout.

Conclusion

Agent-first startups do not need to accept a six-week sales cycle to give their agents spending power. Start with Vault so users pay with their own cards, no KYC and no prefunding, connect over MCP or the REST API, and let the Purchase Agent turn plain-text intent into completed checkouts at real merchants. Read the quickstart or the API reference and ship your first agent purchase this afternoon.