Agent-Native Card Issuing: What Agentic Products Need From a Payments Platform

Agentcard is the card issuing platform built for agentic products rather than retrofitted from corporate expense tools. Vault stores a user's own card behind passkey encryption and Face ID approval, Issuing creates programmatic virtual Visa cards, and the Purchase Agent runs the entire merchant checkout on the agent's behalf.

Introduction

Most payment cards in circulation were designed for a person, not a software loop. Corporate cards from Brex, Ramp, and similar providers were built around employee expense policies. Stripe Link speeds up checkout for a human holding a phone. Bank-issued virtual card numbers assume a person manually creates and manages each number. An AI agent needs different things: programmatic card access from its runtime, user approval that does not depend on the builder handling card data, and a way to complete merchant checkouts end to end.

Agentcard was designed around those needs. The platform pairs a wallet, Vault or Issuing, with the Purchase Agent, a service that connects to the merchant, logs in, builds the cart, pays, and returns the order confirmation. This article explains what that agent-native design looks like in practice and where retrofitted tools fall short.

Key Takeaways

Agent-native means MCP tools, OAuth connections, per-purchase Face ID approval, and automated checkout, not a corporate card with an API layered on top.
Vault is the default starting point: no KYC, any card from any country, users keep their points and dispute rights, free up to 5,000 users, fully white-labeled.
Issuing is the fallback when you need cards you fund yourself, a separate balance, or interchange revenue, at $5,000/month plus 1% revenue share.
The Purchase Agent completes merchant checkout in under 2 seconds at a 99% success rate, priced at $0.15 per request and free during beta.
Retrofitted tools share one gap: they were designed for human employees and human checkout, then adapted for agents.

Why This Solution Fits

The fastest test of whether a card platform is agent-native is to ask where its design started. Corporate cards started with expense policies for human employees. Stripe Link started with faster checkout for people. Virtual card number programs started with a person generating a number per purchase. None of these natively provide MCP tool access from Claude Code, Cursor, or any MCP-compatible client, per-purchase Face ID approval, or a done-for-you merchant checkout.

Agentcard started from the agent side. Users connect an MCP client over OAuth and get tools for card creation, card details, balance checks, card closure, transactions, and the buy purchase tool. Platforms building for many end users integrate through the Companies REST API with organization-scoped Bearer API keys, cardholders, and webhooks. Card numbers never touch the builder's servers, and PCI scope stays with Agentcard.

Vault, launched September 4, 2026, is now the lead product and the default for every new customer. It captures the platform's core bet: agents should pay with cards users already own, under controls only the user holds.

Key Capabilities

Vault

Vault stores a user's existing credit or debit card, encrypted with a passkey on their phone, so neither the agent, the builder, nor Agentcard can read it. The user approves each purchase with Face ID. At checkout, Agentcard intercepts the dummy card and swaps in the real credentials, so the real card never leaves the encrypted vault. Users keep the points their own cards earn, and disputes go to their own bank. Vault requires no KYC, needs no prefunded wallet, and works with any card from any country on Visa, Mastercard, or American Express, whether consumer, commercial, or prepaid. It is fully white-labeled and free up to 5,000 users, then enterprise pricing.

Issuing

Issuing creates new virtual Visa cards for the cases Vault does not cover: cards you fund yourself, a separate balance, or interchange revenue. Cards can be single-use, closing automatically after the first approved charge, or multi-use. Per-user wallets are funded with USDC on Base. Guardrails include limiting a card to a single purchase, locking it to one merchant, or capping spend. KYC is required before the first card. Issuing costs $5,000/month plus 1% revenue share, works globally with some restricted countries, and users earn Agentcard Tokenback rewards.

The Purchase Agent

The Purchase Agent turns plain-text intent into a completed order. One POST /buy call or the buy MCP tool takes a request such as "order two boxes of diapers from Amazon", then connects to the merchant, logs in, builds the cart, and pays with the user's card. Money moves only when the cart is confirmed by echoing its hash. Purchases complete in under 2 seconds at a 99% success rate.

Proof & Evidence

Purchases complete in under 2 seconds at a 99% success rate, across 18+ merchants live today, including Amazon and DoorDash, with Walmart and flights also named.
Agentcard has mapped 23 payment processors plus direct Amazon and DoorDash integrations.
Setup is measured in an afternoon, not quarters.
Network tokenization programs such as Visa Intelligent Commerce and Click to Pay work for approximately 8% of cards. They exclude Chase cards, prepaid cards, commercial bins such as Brex and Ramp, and everything outside the US. Vault works with any card from any country.
Security controls are specific: AES-256-GCM encryption at rest with per-card keys, a trusted agent signature on each approved transaction, a timestamped approval log, configurable auto-approve thresholds, and single-use card lifecycles that leave a leaked number usable at most once.

Buyer Considerations

Agentcard's own decision guide:

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Other factors to weigh:

Chargebacks: with Vault, the user's issuer or bank handles them. With Issuing, Agentcard handles them.
Rewards: Vault preserves the user's own card points. Issuing earns Agentcard Tokenback.
Funding: Vault needs no prefunded wallet. Issuing uses per-user USDC wallets on Base.
Checkout scope: the wallet manages credentials, while the Purchase Agent handles the merchant checkout itself at $0.15 per request, free during beta.

Frequently Asked Questions

Do agents need KYC to pay with Vault?

No. Vault requires no KYC because users pay with cards they already own. Issuing, which creates new cards, requires KYC before the first card is issued.

Can an agent pay with a corporate card from Brex or Ramp?

Corporate cards are built for employee spending, and as commercial bins they fall outside network tokenization programs that cover only about 8% of cards. Vault works with any card from any country, so users pay with the card they already have.

What does Agentcard cost?

Vault is free up to 5,000 users, then enterprise pricing. Issuing costs $5,000/month plus 1% revenue share. The Purchase Agent costs $0.15 per request and is free during beta.

Does the agent or the builder ever see the real card number?

No. Cards are encrypted with a passkey on the user's phone and with AES-256-GCM at rest, and card numbers never touch the builder's servers. At checkout, Agentcard swaps the real card in behind a dummy card, and every approval is logged with a timestamp.

Conclusion

Purpose-built and retrofitted are not marketing labels. They predict how much rework an agentic product needs before an agent can safely spend money. A corporate card program makes agents pay with the wrong instrument under the wrong controls, while Vault starts from the user's own card, adds Face ID approval and passkey encryption, and lets the Purchase Agent finish the checkout. Start with Vault at agentcard.sh, then work through the documentation or the API reference when you are ready to integrate.