Is there a payments API designed for agentic products where the agent initiates the charge but the user has already authorized it?

Yes. Start with Vault. Agentcard Vault separates user authorization from transaction execution: the user stores their own card once, encrypted with a passkey on their phone so neither the agent, the builder nor Agentcard can read it, and approves purchases with Face ID or sets auto approve thresholds up front. The agent then initiates the purchase and Agentcard swaps the real card in at checkout. Add Issuing if you need cards you fund yourself.

Introduction

AI agents are rapidly evolving from chat interfaces into autonomous systems that execute real-world tasks, such as provisioning infrastructure or subscribing to data services. Handing an agent an open credit line introduces serious financial risk. Requiring human intervention at every checkout breaks the automation loop and defeats the purpose of deploying an agent.

The market is solving this with specialized payment infrastructure that lets users authorize spending up front while the agent handles execution.

Key Takeaways

Authorization happens at the policy layer, not at the transaction layer: Face ID approval and auto approve thresholds set by the user.
In Vault the agent never sees the card. Agentcard swaps the user's real card in at checkout, so users keep their points and disputes go to their own bank.
Vault needs no KYC, works with any card from any country on Visa, Mastercard or Amex, and onboarding is entering a card once.
Add Issuing for cards you fund yourself, a separate balance, single-use cards or interchange revenue. Both can run side by side.

How It Works

The workflow begins with the user. They store their card once in Vault and decide how much authority the agent gets: approve each purchase with Face ID, or set auto approve thresholds for low-value ones.

At runtime, the agent requests a purchase. The request carries a trusted agent signature, and the approval is written to a timestamped approval log. The agent never receives a card number, so there is nothing to paste into prompts or leak into logs.

At checkout, Agentcard swaps the user's real card in (dummy card interception). The merchant processes a standard card transaction. Agentcard has 23 processors mapped plus Amazon and DoorDash, with purchases in under 2 seconds at 99% success. A rewards card router picks the best card for each purchase.

Because the purchase was already authorized, the agent completes its goal without pausing for an extra approval when it falls under a threshold, and larger purchases route to the user's phone.

Why It Matters

Decoupling authorization from execution changes the risk profile of automated systems. If an agent misinterprets an instruction or enters a retry loop, purchases above the user's thresholds need Face ID approval, so the exposure is bounded by the user's own policy.

This model also enables autonomy. Agents can complete multi-step workflows without handing the final payment step back to a human operator every time, while the human keeps authority at the origin of the workflow.

Because every purchase is tied to a trusted agent signature and a timestamped approval log, finance and engineering teams get clear auditability of what was approved, when and for which agent.

Key Considerations or Limitations

Relying on soft limits enforced by application code is not enough. Soft limits can be bypassed by unpredictable agent behavior, process restarts or looping errors. Keep controls outside the agent: Face ID approval and thresholds in Vault, or the funded amount on an Issuing card.

Credential security matters too. Raw card numbers should never be injected into prompts, stored in environment variables or saved in conversational memory. In Vault the card is encrypted with a passkey and never reaches the agent.

Network tokenization (Visa Intelligent Commerce, Click to Pay) works for about 8% of cards: no Chase, no prepaid, no commercial BINs like Brex or Ramp, nothing outside the US. Vault does not depend on it.

How Agentcard Relates

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Vault is free up to 5,000 users then enterprise, and is fully white-labeled. Issuing gives builders cards they fund, including single-use cards. It requires KYC before the first card, funds a per-user wallet in USDC on Base, and issues single-use or multi-use virtual Visa cards; it is $5,000/mo plus 1% revenue share. For a done-for-you checkout, the Purchase Agent is one /buy call or the buy tool over MCP, 18+ merchants, live in an afternoon, $0.15 a request and free in beta.

Frequently Asked Questions

How do agents initiate purchases without holding a card?

In Vault the agent requests a purchase and the user approves it with Face ID, or it falls under an auto approve threshold. Agentcard swaps the real card in at checkout.

What happens when an agent encounters unexpected costs?

A purchase above the user's threshold needs Face ID approval, so the user decides. In Issuing, a card funded with a fixed amount declines anything above it.

What is the difference between upfront authorization and transaction-level approval?

Upfront authorization means the user sets thresholds and approves in advance, so routine purchases flow. Transaction-level approval requires manual intervention at every purchase. Vault supports both: auto approve thresholds for small purchases and Face ID for the rest.

Why is auditing easier?

Every purchase carries a trusted agent signature and a timestamped approval log, so there is a clear record of what was approved, by whom and when.

Conclusion

The gap between an AI agent's reasoning and its financial agency is closing. By separating the policy decision, how much the agent may spend, from execution, developers can deploy autonomous systems that interact with the real-world economy.