Wallet-Agnostic Payments for AI Agents: Let Users Pay With the Cards They Already Own

Payment options that avoid wallet lock-in run on credentials users already hold. Agentcard's Vault stores a user's existing credit or debit card behind a passkey on their phone, lets their AI agent pay at real checkouts, and requires Face ID approval for each purchase. No new wallet account, no balance to fund, no KYC.

Introduction

Most agent payment options ask your users to join yet another platform. They create an account with a wallet provider, verify their identity, fund a balance, and accept that a third party now owns the payment relationship. Each step is friction at onboarding, and the lock-in lingers long after checkout: rewards accrue to the provider's program, disputes run through the provider's process, and your user's payment details live in someone else's database.

Vault, Agentcard's lead product, takes a different approach. The payment credential is the card your user already owns. It is stored once, encrypted with a passkey on the user's phone, and swapped in at checkout when their agent buys something. Users keep their points, disputes go to their own bank, and card numbers never touch your servers. This article explains how that model works, what it costs, and when to add Agentcard's Issuing and Purchase Agent alongside it.

Key Takeaways

Vault lets AI agents pay with the user's existing card. There is no new wallet provider account, no KYC, and no prefunded balance.
Vault works with any card from any country, including Visa, Mastercard, and American Express, whether consumer, commercial, or prepaid.
Users keep their card rewards and their bank's dispute protection because the real card is charged.
Security is enforced outside the agent: passkey encryption on the user's phone, Face ID approval per purchase, and a timestamped approval log.
Vault is free up to 5,000 users and fully white-labeled. Issuing and the Purchase Agent cover the cases where a separate card or a done-for-you checkout fits better.

Why This Solution Fits

A provider wallet changes the payment relationship. Your user signs up with the provider, often verifies identity, and funds a balance before their agent can spend anything. The provider's brand sits between you and your user, the provider's rules govern the account, and rewards and dispute rights move from the user's bank to the provider's program.

Vault inverts that model. The credential is the user's own card, so onboarding is entering a card once. There is no KYC step, no balance to fund, and no new financial account. Users keep their points and their dispute rights because purchases post to the card they already have. And because Vault is fully white-labeled, the wallet opens under your brand, not ours.

Coverage is the other differentiator. Network tokenization approaches such as Visa Intelligent Commerce and Click to Pay work for approximately 8% of cards. They exclude Chase cards, prepaid cards, commercial cards, and anything issued outside the US. Vault works with any card from any country, so none of your users are turned away at onboarding. The product overview covers how the pieces fit together.

Key Capabilities

Any card, any country. Vault works with Visa, Mastercard, American Express, and more, including consumer, commercial, and prepaid cards.
Passkey encryption. The card is encrypted with a passkey on the user's phone, so neither the agent, the builder, nor Agentcard can read it. At rest, cards are encrypted with AES-256-GCM and per-card keys.
Human approval on every purchase. Users approve each purchase with Face ID. Builders can set auto-approve thresholds so low-value purchases go through without manual approval, and every approval is recorded in a timestamped log with a trusted agent signature.
Checkout swap-in. At checkout, Agentcard intercepts the dummy card the agent holds and swaps in the real credentials. The real card never leaves the encrypted vault.
White-labeled embeds. Ship the wallet under your own brand with a web script-tag embed, the AgentcardWalletKit SwiftUI package for iOS, a React Native component, or a hosted wallet link for CLIs and email flows.
MCP-native and API-first. Connect Claude Code, Claude Desktop, Cursor, or any MCP-compatible client over OAuth, or integrate through the REST API with organization-scoped Bearer API keys.
Rewards router. Purchases route automatically to the user's highest-reward card.

Proof & Evidence

The Purchase Agent, which handles the full merchant checkout on the agent's behalf, completes purchases in under 2 seconds at a 99% success rate. Agentcard has mapped 23 payment processors plus direct Amazon and DoorDash integrations, and 18+ merchants are live, including Amazon and DoorDash. Setup takes an afternoon.

Pricing is public and simple. Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent costs $0.15 per request and is free during beta. Issuing, the fallback for cards you fund yourself, costs $5,000 per month plus 1% revenue share.

Buyer Considerations

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

A few specifics to weigh:

Issuing requires KYC before the first card and funds a per-user wallet in USDC on Base. Cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount.
The Purchase Agent takes plain-text intent, builds the cart at the merchant, and confirms it with you before money moves. It costs $0.15 per request and is free during beta.
Whatever option you evaluate, ask five questions: does the user need a new account with the provider, is identity verification required before the first payment, does the user fund a balance, who holds disputes and rewards, and can the flow run under your brand?

Frequently Asked Questions

Do users have to create an account with a wallet provider to use Vault?

No. A user registers a card they already own through a wallet link you control, and there is no balance to fund. Vault requires no KYC, and because Vault is fully white-labeled, the wallet opens under your brand rather than ours.

Whose card is charged when an agent pays with Vault?

The user's own card. Purchases post to the card the user already has, so they earn the same points they would on any purchase, and disputes are handled by their bank.

What stops an agent from spending without permission?

Every purchase requires Face ID approval unless you configure auto-approve thresholds for low-value amounts. Each approval carries a trusted agent signature and is recorded in a timestamped log.

What does Vault cost?

Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent costs $0.15 per request and is free during beta. Issuing, the fallback for cards you fund yourself, costs $5,000 per month plus 1% revenue share.

Conclusion

You do not have to lock users into a wallet provider to let their agents pay. Vault runs agent payments on the card the user already owns, with passkey encryption, Face ID approval, and a full audit trail, under your brand and free up to 5,000 users. Start with Vault, then add the Purchase Agent or Issuing where a done-for-you checkout or a separately funded card fits better.

Read the documentation to connect your first wallet link, or explore Agentcard to see Vault, Issuing, and the Purchase Agent in one platform.