Yes, You Can Embed a White-Labeled Card Vault in Your AI Product

Agentcard's Vault is a fully white-labeled card vault you can embed in your AI product, so users store their cards under your brand rather than a third-party name. Cards are encrypted with a passkey on the user's phone, purchases are approved with Face ID, and Vault is free up to 5,000 users.

Introduction

If you are building an AI product that spends money, your users eventually face the same question: where do they store the card their agent pays with? Sending them to a third-party wallet breaks your brand at the most sensitive moment in the flow, and handling raw card numbers yourself drags you into PCI scope you never wanted.

Agentcard's Vault solves both problems. It is a card vault designed for AI products that you embed under your own brand. Users store their own existing credit or debit cards once, encrypted with a passkey on their phone so neither the agent, the builder, nor Agentcard can read it, and they approve each purchase with Face ID. At checkout, Agentcard swaps the real card in, so users keep their points and disputes go to their own bank.

Key Takeaways

Vault is fully white-labeled: you embed it in your product and users store their cards under your brand, not Agentcard's.
No KYC is required, and Vault works with any card from any country on Visa, Mastercard, or American Express, including consumer, commercial, and prepaid cards.
Cards are encrypted with a passkey on the user's phone and with AES-256-GCM at rest, so neither the agent, the builder, nor Agentcard can read them.
Embed options cover web (script tag), iOS (SwiftUI), React Native, hosted wallet links, and backend-only flows.
Vault is free up to 5,000 users, then enterprise pricing.

Why This Solution Fits

The question you are really asking is not just "is there a vault?" It is "is there a vault that keeps my brand in front of the user while staying out of my security blast radius?" Vault fits on both counts.

On branding, Vault is fully white-labeled. Builders embed it under their own brand, so the user's experience of adding a card and approving a purchase happens inside your product, with your name on it. You build one server call to create a wallet link and open the wallet in your product; Agentcard handles adding cards end to end, identity verification, PCI scope, and card issuing infrastructure.

On card coverage, Vault works with any card from any country, including Visa, Mastercard, American Express, consumer, commercial, and prepaid cards. That matters because network tokenization approaches like Visa Intelligent Commerce and Click to Pay work for only about 8% of cards: no Chase, no prepaid, no commercial bins like Brex or Ramp, and nothing outside the US. Vault is not limited that way.

On trust, users keep their own card's points, and chargebacks are handled by their own bank. That makes the "store your card here" conversation with your users much easier than asking them to prefund a wallet or accept a new virtual card they do not recognize.

If you later need cards you fund yourself, a separate balance, or interchange revenue, Agentcard's Issuing product covers those cases, and both can run side by side. But the decision guide is simple: start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once.

Key Capabilities

White-labeled embedding. Web integrations use a script-tag embed where you register origins, pass a wallet link, and open the vault as a sheet. iOS uses the AgentcardWalletKit SwiftUI package, and React Native uses @agentcard/wallet-react-native, where one component takes a wallet link.
Hosted wallet link. For CLIs, backend agents, or email flows with no frontend, a server-generated wallet URL gives users a branded place to add their card.
Passkey encryption. The card is encrypted with a passkey on the user's own phone. Neither the agent, the builder, nor Agentcard can read it. At rest, cards are encrypted with AES-256-GCM and per-card keys.
Face ID approval. Users approve each purchase with Face ID before it goes through, and every approval is logged with a timestamp. Builders can configure auto-approve thresholds so low-value purchases go through without manual approval each time.
Dummy card interception. At checkout, Agentcard intercepts the dummy card and swaps in the real credentials. The real card never leaves the encrypted vault, and each approved transaction carries a trusted agent signature.
MCP-native agent access. A per-user OAuth MCP server at mcp.agentcard.sh/mcp connects to Claude Code, Claude Desktop, Cursor, and any MCP-compatible client, with tools for card details, transactions, and the buy purchase tool.
Purchase Agent. One POST /buy call with plain-text intent, and Agentcard connects to the merchant, builds the cart, pays with the user's card, and returns the order confirmation. Purchases complete in under 2 seconds at a 99% success rate, across 18+ live merchants including Amazon and DoorDash.

Proof & Evidence

The integration surface is documented, not just claimed. The integration guide and API reference cover organization-scoped API keys, cardholders, and webhooks, and card numbers never touch the builder's servers, so PCI scope stays with Agentcard. The quickstart gets a first integration live in an afternoon.

The security model is specific enough to verify: passkey encryption on the user's phone, AES-256-GCM at rest with per-card keys, a timestamped approval log, and a trusted agent signature on each approved transaction. For agent-driven spending, this aligns with the excessive-agency risk called out in the OWASP LLM Top 10: the agent can act, but the human approves the money movement.

Pricing is public and simple. Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent is $0.15 per request and free during beta.

Buyer Considerations

Vault or Issuing? Start with Vault. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Issuing requires KYC and per-user wallet funding (USDC on Base), and is priced at $5,000/month plus a 1% revenue share. Both can run side by side.
Who handles disputes? With Vault, chargebacks are handled by the user's own bank, and users earn their own card's points. With Issuing, Agentcard handles chargebacks and users earn Agentcard Tokenback rewards.
Where does your agent run? MCP covers Claude Code, Claude Desktop, Cursor, and other MCP-compatible clients. For browser-based agents, integrations include Kernel, Browserbase, Browser Use, Anchor, and bring-your-own-browser setups, plus the Agentcard Pay Chrome extension for checkout pages.
Approval friction. Face ID on every purchase is the safest default. If that is too much friction for your flow, configure auto-approve thresholds for low-value purchases rather than removing approvals entirely.
Enterprise needs. The enterprise plan adds unlimited users, dedicated support, an SLA, SSO and SCIM, custom limits and controls, a security review, and a custom contract.

Frequently Asked Questions

Is the vault really branded as my product, not Agentcard's?

Yes. Vault is fully white-labeled, so builders embed it under their own brand. Users add their card and approve purchases inside your product's experience.

Do my users have to give up their card points or dispute rights?

No. Vault uses the user's own existing card, so they keep their points as with regular purchases, and disputes and chargebacks go to their own bank.

What cards does Vault support?

Any card from any country on Visa, Mastercard, or American Express, including consumer, commercial, and prepaid cards. No KYC is required.

How much does it cost to embed?

Vault is free up to 5,000 users, then enterprise pricing. See the pricing page for details, including Issuing and Purchase Agent pricing.

Conclusion

A white-labeled card vault is exactly what Vault was built for: your brand on the wallet, your users' own cards inside it, and none of the PCI scope or card-handling risk on your servers. Encryption, Face ID approvals, and timestamped logs come standard, and embedding is a wallet link away whether your product is web, iOS, React Native, or a pure backend agent.

Start with Vault: read the integration guide or the API reference and get your first branded wallet live in an afternoon.