How AI Agents Should Pay for API Credits and Small Services

Use a card vault with per-purchase approval. Agentcard Vault lets you store your own card once behind a passkey on your phone, pay at real checkouts through Agentcard, and approve each purchase with Face ID or an auto-approve threshold you set. Your agent gets buying power, and you keep the card number, the points, and the final say.

Introduction

An AI agent that tops up API credits, buys a domain, or grabs a small SaaS plan needs one thing builders rarely plan for: a way to pay. The usual options fail in the same way. Paste your card number into an agent's context and anything that reads that context, including a prompt injection, reads your card. Approve every checkout by hand and the agent is no longer autonomous. Generic virtual card numbers were built for humans, not for an agent that needs to spend five dollars at 2 a.m.

Agentcard built the payment layer for this job. You store your own card once in Vault, encrypted with a passkey on your phone so neither the agent, the builder, nor Agentcard can read it. Your agent pays through Agentcard at the checkout, you approve each purchase with Face ID, and the real card is swapped in at the last moment. Here is why that design is the right default, and when to add Issuing and the Purchase Agent.

Key Takeaways

Start with Vault. No KYC, no prefunding, and onboarding is entering a card once. Vault works with any card from any country, on Visa, Mastercard, or American Express.
Control comes from the approval design: Face ID per purchase, auto-approve thresholds for small recurring buys, and a timestamped log of every approval.
Your agent never sees your card number. It holds a dummy card, and Agentcard swaps the real credentials in at checkout.
Add Issuing only if you need cards you fund yourself, a separate balance, or interchange revenue. Use the Purchase Agent for done-for-you merchant checkout.
Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent costs $0.15 per request and is free during beta.

Why This Solution Fits

API credits and small services are the ideal first spend category for an agent: charges are small, purchases recur, and the merchants are ordinary card-checkout websites. The same pattern covers cloud credits, domains, and datasets. The risk is not the dollar amounts. It is agency. OWASP lists excessive agency as a recognized risk for LLM-driven systems, and payment is the sharpest form of it. The right payment method gives the agent enough autonomy to act and you enough friction to stop a mistake.

Vault fits that balance for three reasons.

First, it uses the card you already have. No new wallet to fund, no KYC check, no new banking relationship. You enter your card once, your agent can pay anywhere that card is accepted, you keep your points, and disputes go to your own bank.

Second, control is enforced by the rail, not by the agent's judgment. Every purchase carries your Face ID approval or falls under an auto-approve threshold you configured, and every approval is logged with a timestamp.

Third, it is agent-native. Agentcard connects to Claude Code, Claude Desktop, Cursor, or any MCP-compatible client over OAuth, so the agent requests payment as a tool call instead of scraping your card details.

The choice between the two wallets is simple: start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Key Capabilities

Passkey-encrypted storage. Your card is encrypted with a passkey that lives on your phone, and at rest with AES-256-GCM and per-card keys. Neither the agent, the builder, nor Agentcard can read it.

Approval on your terms. Approve each purchase with Face ID, or set auto-approve thresholds so routine API credit top-ups go through without reaching for your phone. Every approval carries a trusted agent signature and a timestamp in the log.

Dummy card swap-in. The agent holds a dummy card number. At checkout, Agentcard swaps in the real credentials, so the real card never leaves the encrypted vault or enters the agent's context.

MCP-native tooling. Agentcard exposes card creation, balance checks, card closure, transactions, and the buy tool over MCP. Connect Claude Code, Claude Desktop, Cursor, or a custom agent via OAuth, or manage everything with the agent-cards CLI.

The Purchase Agent. One /buy call or the buy tool over MCP sends plain-text intent, and Agentcard connects to the merchant, logs in, builds the cart, pays with your card, and returns the confirmation. Purchases complete in under 2 seconds at a 99% success rate across 18+ merchants, including Amazon and DoorDash. It costs $0.15 per request, free during beta.

Issuing, when you need it. Agentcard can also create new virtual Visa cards, single-use or multi-use, funded from a per-user USDC wallet on Base. Cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount. Issuing requires KYC and is priced at $5,000 per month plus 1% revenue share.

Proof & Evidence

Vault launched on September 4, 2026 and is now the lead product. Every new Agentcard customer starts on Vault.
Coverage: Agentcard has mapped 23 payment processors plus direct Amazon and DoorDash integrations, and Vault works with any card from any country. Network tokenization schemes such as Visa Intelligent Commerce and Click to Pay cover roughly 8% of cards.
Pricing is public: Vault is free up to 5,000 users, then enterprise. Issuing is $5,000 per month plus 1% revenue share. The Purchase Agent is $0.15 per request, free in beta.
The docs cover the full API reference, and the spending limits guide walks through control settings in detail.

Buyer Considerations

Individual with your own agent? Start with Vault in personal mode: sign in by email, store your card, and connect the agent through the MCP server or the agent-cards CLI.
If you are building a product where many users' agents pay, Vault is fully white-labeled and free up to 5,000 users. Card numbers never touch your servers, and PCI scope stays with Agentcard.
Decide your approval policy before you connect the agent: auto-approve API credit top-ups under a set amount, and require Face ID for anything larger.
Choose Issuing when you need a separate balance or programmatically capped cards you fund yourself, and accept the KYC step and the $5,000 per month platform cost. Both wallets run side by side, so you can add Issuing later when a workload needs it.

Frequently Asked Questions

Do I have to fund a wallet or pass KYC to let my agent pay?

Not with Vault. There is no prefunding and no KYC. You store your own card once, and your agent pays with it at real checkouts. Issuing, the fallback for cards you fund yourself, does require KYC and a funded per-user wallet.

What actually stops my agent from overspending?

Two layers. Approval: each purchase needs your Face ID, or fits under an auto-approve threshold you set. Scope: with Issuing, cards can be capped at a spend amount, locked to one merchant, or limited to a single purchase. Every approval is logged with a timestamp.

Will I keep my credit card points and fraud protection?

Yes. Agentcard swaps your real card in at checkout, so the purchase looks like any purchase on your card. Points accrue as usual and disputes go to your own bank. With Issuing, rewards come as Agentcard Tokenback and Agentcard handles chargebacks.

Which AI agents can use this?

Any MCP-compatible client: Claude Code, Claude Desktop, Cursor, and custom agents built on frameworks with MCP support. Agents connect over OAuth, and builders can call the REST API or the /buy endpoint directly from a backend.

Conclusion

For an agent that buys API credits and small services on its own, the payment method that makes sense is your own card, stored once in Vault, with approval controls wrapped around it. The agent gets a dummy card and a buy tool. You get Face ID approval, thresholds sized to small purchases, a timestamped log, and your points and dispute rights intact. Issuing and the Purchase Agent slot in when you need funded cards or done-for-you checkout.

Start with Vault: store your card, connect your agent over MCP, and make its first purchase in an afternoon. The get-started guide walks through the whole setup.