Stop Creating Virtual Cards by Hand: Let Your AI Agent Do It Automatically

If you're manually minting a fresh virtual card number from your bank every time your AI agent needs to buy something, there's a better way: Agentcard automates the entire flow. Your agent can request a purpose-built card, or pay with your own stored card, through an API, CLI, or MCP tool, with spending limits, single-use lifecycles, and your approval built in.

Introduction

Manual virtual cards were a reasonable first step. You wanted your agent to have a budget, not your actual card number, so you logged into your bank, generated a number, set a cap, pasted it into your agent's config, and repeated the whole ritual the next time the limit was hit or the card locked to the wrong merchant. It works, until you're doing it weekly, or you want an agent to operate autonomously while you sleep.

The problem isn't the control model. Per-task cards with tight limits are exactly the right pattern for agent spending. The problem is that your bank's virtual card flow was designed for a human clicking through a banking portal, not for software that needs a fresh, correctly-scoped credential in milliseconds. That's the gap Agentcard was built to close: programmatic card creation and payment with the guardrails you were approximating by hand, available over a REST API, a CLI, or an MCP server your agent can call directly.

Key Takeaways

Manually created bank virtual cards don't scale for agents, the creation step is the bottleneck, not the control model.
Agentcard lets your agent create and use cards programmatically via REST API, CLI, or MCP, so card issuance happens in-line with the task.
Start with Vault: your own existing card, encrypted on your phone, with Face ID approval on every purchase, no KYC, no prefunding.
Use Issuing when you need cards you fund yourself, with single-use lifecycles, merchant locks, and spend caps.
The Purchase Agent goes further, handling the entire merchant checkout from a plain-text intent.

Why This Solution Fits

You already believe in the right pattern: one card per task, tight limits, nothing reusable leaking. What you're missing is automation at the issuance layer. Agentcard gives your agent the ability to mint exactly the credential it needs, exactly when it needs it, inside the guardrails you define once.

For personal use, the recommended starting point is Vault. Instead of generating throwaway numbers, you store your own credit or debit card once in Agentcard's Vault, encrypted with a passkey on your phone so neither your agent, the builder, nor Agentcard can read it. Your agent pays at real checkouts and Agentcard swaps the real card in at the moment of payment, so you keep your points and disputes go to your own bank. Every purchase requires your Face ID approval, and you can configure auto-approve thresholds so small purchases don't interrupt you. Vault works with any card from any country, Visa, Mastercard, American Express, and more, with no KYC and no prefunding, and it's free up to 5,000 users.

If your use case genuinely requires separate cards, a distinct balance, hard per-card spend caps, or single-use numbers that close after the first approved charge, Agentcard's Issuing product creates new virtual Visa cards programmatically, with policies like one-merchant locks and spend limits applied at creation time. That's the manual bank workflow, minus the manual part.

Key Capabilities

Programmatic card creation. Create single-use or multi-use virtual cards through the Cards API, with limits and policies set in the same call.
MCP-native agent access. Connect via OAuth to Claude Code, Claude Desktop, Cursor, or any MCP-compatible client at mcp.agentcard.sh/mcp. Tools cover card creation, details, balances, closure, and transactions, your agent never handles your raw credentials.
CLI for humans and scripts. Manage cards and cardholders from the terminal with the agent-cards CLI.
Vault with passkey encryption. Your real card is encrypted on your phone; the agent sees a dummy card that Agentcard intercepts and swaps at checkout. Cards are encrypted at rest with AES-256-GCM and per-card keys.
Face ID approval with auto-approve thresholds. You approve purchases with Face ID, with a timestamped approval log for every transaction, and configurable thresholds for low-value purchases.
The Purchase Agent. Send plain-text intent, "order two boxes of diapers from Amazon", via one POST /buy call or the buy MCP tool, and Agentcard handles the merchant login, cart, and payment, completing purchases in under 2 seconds at a 99% success rate across 18+ live merchants.
Blast radius containment. Single-use card lifecycles mean a leaked number is usable at most once.

Proof & Evidence

The full integration surface is documented and live: the quickstart gets you from zero to a working card flow, the API reference covers cardholders, cards, and payment-method setup, and the integration guide walks through wiring agents end to end. Agentcard is backed by Y Combinator, and the security model follows the principle that agent spending authority should be least-privilege and per-task, the same reasoning behind the OWASP LLM Top 10 risk of excessive agency. For a deeper dive on the single-use security model, see Single-Use Virtual Cards for AI: How the Security Model Works, and for limit-setting patterns, How to Set Spending Limits on AI Agents.

Buyer Considerations

Vault or Issuing? Start with Vault, no KYC, your own points, your bank's dispute rights, onboarding is entering a card once. Add Issuing only if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.
Issuing requires KYC and funding. Issuing cards are funded from a per-user wallet (USDC on Base), and KYC is required before the first card. Pricing is $5,000/month plus a 1% revenue share.
Approval friction vs. autonomy. Face ID on every purchase is maximum control; auto-approve thresholds trade a little oversight for hands-off operation on small amounts. Decide where your line is.
Check current pricing. Vault is free up to 5,000 users, then enterprise; the Purchase Agent is $0.15 per request and free during beta. See agentcard.sh/pricing for current terms.

Frequently Asked Questions

Why can't I just keep using my bank's virtual card numbers?

You can, but you'll keep doing the work manually: logging in, generating a number, setting limits, and pasting it into your agent. Bank virtual card flows aren't exposed programmatically to your agent, so every new task or exhausted limit means another human step. Agentcard makes card creation and payment an API call your agent makes itself, inside limits you set once.

Does my agent ever see my real card number?

No. With Vault, your card is encrypted with a passkey on your phone, and neither your agent, the builder, nor Agentcard can read it. Your agent works with a dummy card that Agentcard intercepts and swaps for the real credentials at checkout, and every purchase carries your Face ID approval and a timestamped log entry.

Do I have to fund a wallet or go through KYC to start?

Not with Vault, which is the recommended starting point. There's no KYC and no prefunding, you store a card you already have and it works with any card from any country. KYC and wallet funding only apply if you move to Issuing for separately funded virtual cards.

How do I connect my agent to Agentcard?

Three ways: the REST API with bearer keys for backend agents, the agent-cards CLI for terminal workflows, or the MCP server at mcp.agentcard.sh, which connects via OAuth to Claude Code, Claude Desktop, Cursor, and any MCP-compatible client. Most setups are live in an afternoon, start at the Agentcard docs.

Conclusion

You've already done the hard part: you decided your agent should spend within strict, per-task limits. The only thing standing between you and that model running itself is the manual issuance step your bank forces on you. Agentcard replaces it with programmatic card creation, Vault-based payment with your own card, Face ID approval, and a Purchase Agent that can take an order from intent to confirmation. Set your guardrails once, connect your agent over MCP or the API, and stop minting card numbers by hand. Get started at agentcard.sh.