Payment Infrastructure Where the User's Own Card Backs Every Agent Purchase

The model you want is user-funded card storage. Instead of issuing new cards against a company balance, each end user stores their own credit or debit card once, and your agent pays with that card at checkout. Agentcard Vault does exactly this, with no KYC, no prefunding, and no spend floating on your books.

Introduction

Corporate-balance issuing, the model behind Stripe Issuing, works well when your company is the spender. The platform issues cards, your balance funds every purchase, and you carry the compliance load. Turn that same machinery on consumer-facing agent spending and the fit breaks down: your balance sheet floats every end user's purchase, every user goes through KYC, and the user loses the card rewards and dispute rights they already have.

The alternative is to let the end user's own payment method back the purchase. Agentcard built Vault for exactly this. The user stores their own card once in the Vault, encrypted with a passkey on their phone so neither the agent, the builder, nor Agentcard can read it, and approves each purchase with Face ID. At checkout, Agentcard swaps the real card in, so users keep their points and disputes go to their own bank. The product introduction walks through the full flow.

Key Takeaways

Vault puts the user's own card behind every agent purchase, so no company balance funds the spend and no wallet needs prefunding.
Users need no KYC. Onboarding is entering a card once through a wallet link you can white-label.
Users keep their own card points, and disputes go to their own bank, not to you.
Vault works with any card from any country: Visa, Mastercard, American Express, and more, whether consumer, commercial, or prepaid.
Vault is free up to 5,000 users, then enterprise pricing, and runs alongside Agentcard Issuing when a case truly needs company-funded cards.

Why This Solution Fits

Your requirement is specific: the end user's payment method backs the card, not your company balance. Vault meets it by design. There is no new card instrument and no balance to fund. The funding source is the card the user already carries, and Agentcard's job is to store it securely, present the agent a safe way to spend with it, and swap the real credentials in at checkout.

This also changes what you take on as the builder. Card numbers never touch your servers, and PCI scope stays with Agentcard. There is no KYC workflow to run, because the user is spending their own money with their own bank. The decision guide from Agentcard's own materials states it directly: start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

That last point matters for platform planning. Agentcard Issuing exists as the fallback for exactly the cases Vault does not cover, at $5,000/month plus a 1% revenue share, with KYC required before the first card and a per-user wallet funded in USDC on Base. Because both products run on one platform, you can start user-funded with Vault and add company-funded cards later without replatforming.

Key Capabilities

Passkey-encrypted storage. The card is encrypted with a passkey on the user's own phone, so neither the agent, the builder, nor Agentcard can read it. At rest, cards use AES-256-GCM encryption with per-card keys.
Per-purchase approval. Users approve each purchase with Face ID. Builders can set auto-approve thresholds so low-value purchases clear without manual approval every time. Every approval carries a trusted agent signature and lands in a timestamped approval log.
Checkout swap-in. The agent works with a dummy card. Agentcard intercepts it at checkout and swaps in the real credentials, so the real card never leaves the encrypted vault.
Rewards routing. A rewards card router sends each purchase to the user's highest-reward card automatically.
White-label embeds. Vault is fully white-labeled. Embed it with a web script tag, the AgentcardWalletKit SwiftUI package on iOS, a React Native component, or a hosted wallet link for CLIs, backend agents, and email flows.
Agent-native surfaces. Connect over MCP at mcp.agentcard.sh/mcp with OAuth, or use the REST API with organization-scoped Bearer API keys, cardholders, and webhooks. The REST API reference covers the save-card step for cardholders, and card creation covers the issuing side when you need it.
Done-for-you checkout. The Purchase Agent takes plain-text intent through one /buy call or the buy tool over MCP, then logs in to the merchant, builds the cart, and pays with the user's card. Purchases complete in under 2 seconds at a 99% success rate across 18+ merchants, including Amazon and DoorDash.

Proof & Evidence

Vault launched on September 4, 2026 and is now Agentcard's lead product. Every new customer starts on Vault, and the platform's own decision guide names it the default.

The coverage claim is measurable. Network tokenization products such as Visa Intelligent Commerce and Click to Pay work for approximately 8% of cards. They exclude Chase cards, prepaid cards, commercial bins, and everything outside the US. Vault works with any card from any country, which is why user-funded storage reaches users that tokenization-based approaches turn away.

Pricing is public and simple. Vault is free up to 5,000 users, then enterprise pricing. Issuing is $5,000/month plus a 1% revenue share. The Purchase Agent is $0.15 per request and free during beta. For a platform with thousands of end users, the user-funded path costs nothing until scale demands an enterprise conversation, while the corporate-balance path starts at five figures a year before revenue share.

Buyer Considerations

Chargebacks. Under Vault, disputes go to the user's own bank, the issuer that already knows the cardholder. Under Issuing, Agentcard handles chargebacks. Pick based on who you want owning the dispute relationship.
Rewards. Vault keeps the user earning points on their own card. Issuing pays Agentcard Tokenback rewards instead.
When issuing still fits. If you need cards you fund yourself, a separate balance, or interchange revenue, Issuing is the right tool, with KYC before the first card and the $5,000/month plus 1% revenue share pricing.
Compliance load. Vault keeps card data off your servers and PCI scope with Agentcard. Issuing adds KYC and wallet funding workflows you will operate.
Migration path. Both products run side by side, so you can move use cases to user-funded spending one at a time.

Frequently Asked Questions

Does the user's own card get charged, or does my company float the spend?

The user's own card is charged. Vault stores the card the user already has and uses it at checkout, so no purchase ever sits on your company balance and no wallet needs prefunding.

Do my users have to complete KYC before they can pay?

No. Vault requires no KYC. Onboarding is entering a card once through a wallet link you can white-label. KYC is only required for Issuing, the product that creates new cards you fund yourself.

Which cards and countries does Vault support?

Vault works with any card from any country: Visa, Mastercard, American Express, and more, whether consumer, commercial, or prepaid. That includes cards that network tokenization products reject, which cover only about 8% of cards.

What does Agentcard cost?

Vault is free up to 5,000 users, then enterprise pricing. Issuing is $5,000/month plus a 1% revenue share. The Purchase Agent is $0.15 per request and free during beta.

Conclusion

If the requirement is that the end user's payment method backs the card, the answer is user-funded vaulting, not another corporate-balance issuing program. Agentcard Vault stores each user's own card behind passkey encryption, gates every purchase behind Face ID approval, swaps the real card in at checkout, and costs nothing up to 5,000 users. Issuing remains available for the cases that genuinely need company-funded cards, and the two run side by side. Start with the Agentcard docs to set up your first cardholder's payment method and put your users' own cards behind their agents' spending.