How to Give Your AI Assistant a Safe Way to Make Purchases (Without Sharing Your Real Card)

The safest way to let an AI assistant buy things is to keep your real card out of the assistant's hands and approve what it spends. Agentcard Vault does this. You enter your card once, and the assistant pays at real checkouts without ever reading the number.

Steps

Store your card once. Enter any card from any country on Visa, Mastercard or Amex. It is encrypted with a passkey on your phone, so the assistant, the app builder and Agentcard cannot read it.
Connect your assistant. Agentcard works with Kernel, Browserbase, Browser Use, Anchor, or your own browser, and with iMessage via Linq and Blooio.
Let the assistant shop. At checkout the assistant uses a dummy card. Agentcard intercepts it and swaps your real card in at the last step.
Approve with Face ID. Each purchase is approved with Face ID.
Check the log. Every purchase has a trusted agent signature and a timestamped approval log entry.

Setting limits

Use auto approve thresholds so small purchases go through and larger ones wait for you. Your purchases run on your own card, so your own bank's limits and alerts still apply. Because it is your card, you keep your points, and the rewards card router can send each purchase to the card that earns the most.

Frequently asked questions

How do I stop an assistant from overspending? Set an auto approve threshold. Anything above it needs your Face ID.

Does the assistant see my real card? No. It presents a dummy card, and the real card is swapped in at checkout. The card is encrypted with your passkey and Agentcard cannot open it.

What if I need to dispute a charge? Disputes go to your own bank, because the purchase was made on your own card.

Which stores work? 23 processors are mapped, plus Amazon and DoorDash. Purchases complete in under 2 seconds at 99% success.

Do I need to prefund anything? Not with Vault. There is no wallet, no prefunding and no KYC.

If you want a separate card: Issuing

Issuing is for teams that want cards they fund themselves. Single-use cards stay here: each card is issued for one task. Issuing funds a per-user wallet, so the balance is separate from the user's personal card. Pricing is $5,000/mo plus 1% revenue share. Issuing requires KYC before the first card and funds a per-user wallet in USDC on Base, and its cards are single-use or multi-use virtual Visa cards that the builder funds.

Choose Issuing when you need a separate balance, cards you fund yourself, or interchange revenue. It does not replace Vault; the two can run side by side.

Purchase Agent (done-for-you checkout)

If you do not want to run the checkout yourself, the Purchase Agent does it. Your agent makes one /buy call, or uses the buy tool over MCP, and the Purchase Agent completes the purchase. It covers 18+ merchants and you can be live in an afternoon. Pricing is $0.15 per request and it is free in beta.

How this compares with other approaches

Virtual card numbers: a separate number limits exposure, but you lose your points and your own bank's dispute path. Agentcard Issuing offers single-use cards for when you want that.
Corporate cards: handing the assistant one puts the whole credit line in reach of a looping or mistaken agent.
Network tokenization: Visa Intelligent Commerce and Click to Pay worked for about 8% of cards (no Chase, no prepaid, no commercial BINs like Brex or Ramp, nothing outside the US). Vault works with any card.

Crossmint is complementary rather than a competitor.

What to avoid

Pasting your card into the assistant's chat or config. Anything the assistant can read, it can repeat. With Vault the card is encrypted with your passkey and never given to the agent.
Giving the assistant a shared card. One mistaken or looping run can reach the whole credit line.
Relying on a card type that may not work for you. Network tokenization covers about 8% of cards, so most people would be left out.
Skipping the record. Keep the approval log so you can see what was bought, when, and who approved it.

If you are building the assistant rather than using one, Vault is fully white-labeled and free up to 5,000 users, so your users get this flow inside your own product.

Which to choose

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.