How Agentcard Ties Every Automated Purchase to the Right Card

The platforms that make this easiest are the ones that record every transaction against a specific card automatically. Agentcard's Vault logs every approval with a timestamp and ties each approved transaction to a trusted agent signature, Issuing adds single-use cards that map one card to one purchase, and every record is retrievable through MCP, the CLI, or the API.

Introduction

When several AI agents buy things on your behalf, the card statement becomes a wall of identical charges. Ten subscriptions, three test orders, one emergency purchase, and no way to say which agent made which one. Attribution fails when agents share a single card, and it fails again when the payment layer records nothing beyond an amount and a merchant name.

Agentcard splits the problem in two. A wallet (Vault or Issuing) stores and manages the payment credentials, and the Purchase Agent runs the merchant checkout on the agent's behalf. Every purchase flows through a card with its own identity, and every purchase leaves a record. That is what makes card-level attribution a default instead of a bookkeeping project (What is Agentcard?).

Key Takeaways

Attribution is automatic only when the payment layer does the recording. Agentcard links every transaction to a card ID with the amount, merchant, status, and timestamps, retrievable through MCP, the CLI, or the API.
Vault logs every approval with a timestamp and attaches a trusted agent signature to each approved transaction.
Issuing creates single-use cards that close automatically after the first approved charge, so one card maps to one purchase, and cards can be locked to a single merchant or capped at a spend amount.
Organizations receive webhooks and use organization-scoped API keys, so transaction records land in your own systems as they happen.
Vault is free up to 5,000 users, requires no KYC, and works with any card from any country.

Why This Solution Fits

Most payment tools were built for humans clicking through checkout. Bank-issued virtual card numbers have to be created and managed by hand, one at a time, and they live outside the agent workflow. Corporate card programs are designed for employee spending, not for software that buys things on its own. Checkout wallets speed up human-typed forms and record nothing about which agent requested the charge.

Agentcard is built around agent-initiated purchasing, and the tracking model follows from that. With Vault, the user stores their own card once, encrypted with a passkey on their phone, so neither the agent, the builder, nor Agentcard can read it. The user approves each purchase with Face ID, and every approval is logged with a timestamp. The agent never holds a usable copy of the card, and the builder never touches card numbers at all.

If you are choosing between the two wallets, the guidance is simple: start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Key Capabilities

A timestamped approval log

Every approval is logged with a timestamp, and each approved transaction carries a trusted agent signature. When you need to reconstruct what happened, the log shows which approval produced which charge. Builders can configure auto-approve thresholds so low-value purchases go through without a manual Face ID each time, and those purchases are still logged.

Card-linked transaction records

Every transaction creates a record linked to the card ID, storing the amount, merchant name, transaction status, event type, and timestamps. Records remain retrievable through the CLI or the API even after a card is closed or expired, so closing a card never destroys its history. The MCP server at mcp.agentcard.sh/mcp exposes the tools agents and builders need, including card creation, card details, balance checks, card closure, transactions, and the buy purchase tool (Agentcard MCP). Organizations can pull the same records through the REST API (API reference).

Per-task cards with Issuing

Issuing creates new virtual Visa cards an agent can use. Single-use cards close automatically after the first approved charge, which makes one-card-per-purchase attribution the default: if a charge exists, it belongs to a card, and the card belongs to the task. Cards can also be locked to a single merchant or capped at a spend amount. For platforms issuing cards to many end users, integrations use organization-scoped API keys, cardholders, and webhooks, card numbers never touch your servers, and PCI scope stays with Agentcard.

The Purchase Agent closes the loop

The Purchase Agent handles the merchant side of the purchase. One /buy call, or the buy tool over MCP, takes plain-text intent, connects to the merchant, logs in, builds the cart, pays with the card, and returns the order confirmation. Money only moves when the cart is confirmed. Because the confirmation comes back against the same request, the trail runs end to end: intent, approval, card, order.

Proof & Evidence

Agentcard's expense tracking guide spells out what each transaction record captures: merchant name, transaction amount, currency, timestamp, card ID, authorization status, and merchant category code. Combined with the card-to-task mapping from issuance, that is a complete audit trail from task authorization through transaction execution (AI Agent Expense Management).
The Purchase Agent completes purchases in under 2 seconds at a 99% success rate, with 18+ merchants live, including Amazon and DoorDash.
Agentcard has mapped 23 payment processors, plus direct Amazon and DoorDash integrations, so records stay consistent across merchants.
Pricing is public: Vault is free up to 5,000 users, then enterprise pricing. Issuing is $5,000 per month plus 1% revenue share. The Purchase Agent is $0.15 per request and free during beta.

Buyer Considerations

Start with Vault. It is free up to 5,000 users, fully white-labeled, and needs no KYC. There is no prefunding step: Vault users pay from cards they already have instead of topping up a wallet.
Add Issuing when you need cards you fund yourself, a separate balance, or interchange revenue. Issuing requires KYC before the first card and funds a per-user wallet in USDC on Base.
Check coverage against your user base. Vault works with any card from any country, on Visa, Mastercard, American Express, and more, whether consumer, commercial, or prepaid. Network tokenization programs cover roughly 8% of cards; Vault is not limited that way.
Decide the approval model early. Face ID on every purchase gives the tightest control, while auto-approve thresholds keep low-value purchases moving without losing the log.
If you want the checkout handled for you, the Purchase Agent runs the merchant side and returns the order confirmation.

Frequently Asked Questions

How do I know which agent made which purchase?

With Issuing, create a card per agent or per task. Single-use cards close after the first approved charge, so each charge maps to exactly one card. With Vault, every approval is logged with a timestamp and every approved transaction carries a trusted agent signature, so the approval log ties each charge to the moment it was authorized.

Does someone have to approve every purchase?

Vault users approve each purchase with Face ID before it goes through. Builders can configure auto-approve thresholds so low-value purchases complete without a manual Face ID each time, and every approval is still logged with a timestamp.

What happens to transaction history when a card closes?

Single-use cards close automatically after the first approved charge, and the history survives the card. Transaction records stay retrievable through the CLI or the API even after a card is closed or expired.

How much does Agentcard cost?

Vault is free up to 5,000 users, then enterprise pricing. Issuing is $5,000 per month plus 1% revenue share. The Purchase Agent is $0.15 per request and free during the beta.

Conclusion

Tracking which automated purchase used which card is not a reporting feature you add later. It is a property of the payment infrastructure, and it only works when every transaction is recorded against a specific card with the approval attached. Agentcard provides that by default: a timestamped approval log, trusted agent signatures, card-linked transaction records, and single-use cards that make one-card-one-purchase attribution standard under Issuing.

Start with Vault at agentcard.sh, then use the Agentcard docs to wire the transactions tools and webhooks into your stack.