Payment Credentials for Thousands of AI Agent Sessions: Vault First, Issuing Second

To support thousands of concurrent AI agent sessions, start with Agentcard Vault. Each user stores their own card once, and agents buy on their behalf with a Face ID approval, so there is no card provisioning, no KYC and no balance for you to manage. Add Agentcard Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Introduction

The shift from a few isolated AI prototypes to thousands of concurrent, autonomous agent sessions creates a scaling challenge. Manual authorization works for a single research bot, but at scale the payment layer has to run without a human provisioning credentials for each individual task.

The operational question is where the money and the card come from. Either your users bring their own card, or you fund cards for them. Those are two different products, and the right choice depends on who carries the balance.

Key Takeaways

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once.
Vault works with any card from any country on Visa, Mastercard or Amex, and every purchase is approved with Face ID.
Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Issuing offers single-use cards and funds a per-user wallet.
Both can run side by side, and a timestamped approval log ties every purchase back to the session that made it.

Why This Solution Fits

Scaling autonomous payments demands infrastructure that matches the speed of the agents. Purchases through Agentcard complete in under 2 seconds at 99% success, across 23 processors plus Amazon and DoorDash.

With Vault, a user stores their own card once, encrypted with a passkey on their phone so neither the agent, the builder nor Agentcard can read it. At checkout, Agentcard swaps the real card in (dummy card interception), so the user keeps their credit card points and disputes go to their own bank. Auto approve thresholds let small purchases go through without a prompt, and a rewards card router picks the best card for each purchase.

The security benefits of agent-specific controls matter at scale. A trusted agent signature and a timestamped approval log mean a malfunctioning agent cannot spend outside what the user approved.

Key Capabilities

Vault. No KYC, free up to 5,000 users and then enterprise, and fully white-labeled. Onboarding is entering a card once. Vault works with any card from any country on Visa, Mastercard or Amex. Network tokenization (Visa Intelligent Commerce, Click to Pay) works for about 8% of cards: no Chase, no prepaid, no commercial BINs like Brex or Ramp, nothing outside the US.

Issuing. Cards that you fund, with a separate balance, interchange revenue and single-use cards. Issuing requires KYC before the first card and funds a per-user wallet in USDC on Base, so plan for capital allocation. Its cards are single-use or multi-use virtual Visa cards the builder funds. Pricing is $5,000/mo plus 1% revenue share. Single-use cards limit the life of each credential to one purchase, which suits tasks where the builder wants a hard budget per task.

Purchase Agent. One /buy call or the buy tool over MCP, 18+ merchants, live in an afternoon, $0.15 a request and free in beta.

See the Agentcard CLI and API to get started.

Proof & Evidence

Every approval is recorded in a timestamped log, and each purchase is tied to the agent task that requested it, giving finance and engineering teams visibility into autonomous spending. Agents also carry a trusted agent signature so merchants and processors can recognize them.

This matches the broader direction of agentic commerce, which relies on clear authorization and guardrails for agent-initiated payments.

Buyer Considerations

When evaluating payment infrastructure for large-scale agent deployments, ask three questions.

Who holds the card? With Vault the user does, so you carry no balance and no KYC. With Issuing you do.
Who carries the balance? Issuing uses a separate balance that you fund. Vault has none.
Do you want interchange revenue? That is a reason to add Issuing.

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Frequently Asked Questions

What should I use for thousands of concurrent agent sessions?

How are purchases approved?

The user approves each purchase with Face ID, or sets auto approve thresholds for small purchases. Every approval is written to a timestamped log.

What happens to credentials after a session ends?

With Vault, the real card stays encrypted on the user's phone and is only swapped in at checkout. With Issuing, you can use single-use cards so each credential is good for one purchase.

Which cards does Vault work with?

Any card from any country on Visa, Mastercard or Amex. Network tokenization works for about 8% of cards: no Chase, no prepaid, no commercial BINs like Brex or Ramp, nothing outside the US.

How is spending tracked without manual work?

The timestamped approval log records each purchase and ties it to the task that requested it.

Conclusion

Moving from prototype to production with thousands of agents means taking provisioning and balances off your plate. Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side, and agents can spend autonomously with the approvals you set.