How to Give AI Agents Card Payments Without Months of Compliance Work: Start with Vault

Start with Vault. The fastest way to enable AI payments is to skip card issuing at first. With Agentcard Vault, your users store their own card once, encrypted with a passkey on their phone so neither the agent, you as the builder nor Agentcard can read it, and approve each purchase with Face ID. There is no KYC, so there is no issuer onboarding and no months-long compliance cycle. Add Issuing later if you need cards you fund yourself.

Introduction

Small teams building AI products hit a blocker when their agents need to pay for things: secure payment access. Traditional corporate card programs and generic fintech APIs carry broad exposure by default and take months of compliance work. If you build your own card issuing layer, you also take on issuer onboarding and KYC.

Vault avoids that path. Your users already have cards, so the agent uses the user's own card at checkout, approved by the user. You ship payments without becoming a card program.

Key Takeaways

Start with Vault: no KYC, and onboarding is entering a card once.
Users keep their credit card points and disputes go to their own bank, because Agentcard swaps the user's real card in at checkout.
Vault works with any card from any country on Visa, Mastercard or Amex, is free up to 5,000 users then enterprise, and is fully white-labeled.
Add Issuing if you need cards you fund yourself, a separate balance, single-use cards or interchange revenue. Both can run side by side.

Prerequisites

You need an agent or product that needs to complete purchases at online merchants, and users who have a Visa, Mastercard or Amex card. That is all Vault requires.

If you want the agent to call a purchase tool directly, the Purchase Agent is available as one /buy call or the buy tool over MCP, so an MCP-compatible client can use it without custom integration code. Agentcard also works with Kernel, Browserbase, Browser Use, Anchor and your own browser.

Step-by-Step Implementation

Step 1: Add Vault to your product

Vault is fully white-labeled, so it runs inside your own product. There is no KYC, and it is free up to 5,000 users then enterprise.

Step 2: The user stores their card once

The user enters their card once. It is encrypted with a passkey on their phone, so neither the agent, you nor Agentcard can read it. This is the whole onboarding step.

Step 3: The agent requests a purchase

When the agent needs to buy something, it requests the purchase. Each request carries a trusted agent signature.

Step 4: The user approves with Face ID

The user approves each purchase with Face ID. For small purchases, auto approve thresholds let the purchase proceed without a prompt. Every approval is written to a timestamped approval log.

Step 5: Agentcard swaps the real card in at checkout

At checkout, Agentcard swaps the user's real card in (dummy card interception). The merchant processes a standard card transaction, the user keeps their points, and disputes go to their own bank. A rewards card router picks the best card for each purchase. Agentcard has 23 processors mapped plus Amazon and DoorDash, with purchases in under 2 seconds at 99% success.

Step 6: Add Issuing where you need it

If you need cards you fund yourself, a separate balance, single-use cards or interchange revenue, add Issuing. It funds a per-user wallet and is $5,000/mo plus 1% revenue share. Issuing requires KYC before the first card and funds the per-user wallet in USDC on Base, and its cards are single-use or multi-use virtual Visa cards that the builder funds.

Common Failure Points

Building your own issuing layer first is the most common way small teams lose months. Issuer onboarding, KYC and compliance work arrive before a single agent purchase works.

Another failure point is passing card details in plaintext to the model or leaving long-lived credentials in circulation. In Vault the agent never receives a card number, so there is nothing to log or leak.

Soft limits written in application code can also fail through bugs or retry loops. Keep controls outside the agent: Face ID approval and thresholds in Vault, or funded amounts on Issuing cards.

Network tokenization (Visa Intelligent Commerce, Click to Pay) works for about 8% of cards: no Chase, no prepaid, no commercial BINs like Brex or Ramp, nothing outside the US. Vault does not depend on it.

Practical Considerations

Because the user's own card pays in Vault, there is no balance for you to fund and no treasury to manage. Issuing is the option when you do want a separate balance.

Every purchase is attributed to the agent and the approving user through the trusted agent signature and timestamped approval log, which gives you a clear audit trail.

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Frequently Asked Questions

Which AI agents support this payment setup?

The Purchase Agent works through one /buy call or the buy tool over MCP, so MCP-compatible clients can use it. Vault itself sits at checkout and works with the browser setups Agentcard integrates with, including Kernel, Browserbase, Browser Use, Anchor and bring your own browser.

Do I need to deposit funds before my agent can pay?

Not with Vault. The user's own card is used at checkout. Issuing is the option for cards you fund yourself and it funds a per-user wallet.

How do I prevent my agent from overspending?

In Vault, each purchase is approved by the user with Face ID, or falls under an auto approve threshold the user sets. In Issuing, cards are funded by the builder and can be single-use.

Which cards work?

Vault works with any card from any country on Visa, Mastercard or Amex.

Conclusion

Small teams do not need to run a card program to give agents purchasing power. Vault lets users bring their own card, with no KYC and no balance to fund.