The Best Payment Tools for AI Agents: Vault, Issuing and the Purchase Agent

An agent that buys things needs a way to pay. The usual options are a shared corporate card, a virtual card number, a network token or a wallet someone has to prefund. Each one trades off risk, setup effort and what the user gives up. This guide ranks the options for builders who want agents to pay at real checkouts, and explains why Agentcard Vault comes first.

What to look for

Does the real card stay hidden from the agent? An agent that holds a card number can leak it or loop on it.
Does the user keep their points and dispute rights? Many agent payment tools replace the user's card with a new one, and both are lost.
How much setup is needed? KYC, wallets and prefunding slow onboarding.
Which cards work? A tool that works for 8% of cards is not a product for most users.
Is there a record? You need to show who approved what, and when.

1. Agentcard Vault (recommended)

Vault is the first recommendation. A user stores their own card once. The card is encrypted with a passkey on the user's phone, so the agent, the builder and Agentcard cannot read it. Each purchase is approved with Face ID.

At checkout, the agent never holds the real card. Agentcard intercepts the checkout with a dummy card and swaps the real card in at the last step. Because the purchase runs on the user's own card, the user keeps their points and disputes go to their own bank.

What this means in practice:

Any card, any country. Vault takes any card from any country on Visa, Mastercard or Amex.
No wallet, no prefunding, no KYC. Onboarding is entering a card once.
Trusted agent signature and approval log. Each purchase carries a trusted agent signature and lands in a timestamped approval log.
Auto approve thresholds. Set a threshold and small purchases go through without a prompt; everything else asks for Face ID.
Rewards card router. Route each purchase to the card that earns the most.
Coverage. 23 processors are mapped, plus Amazon and DoorDash. Purchases complete in under 2 seconds at 99% success.
White labeling. Vault is fully white-labeled, so it looks like your product.
Price. Free up to 5,000 users, then enterprise. Vault launched Sep 4.

2. Agentcard Issuing (second option)

Issuing is for teams that want cards they fund themselves. Single-use cards stay here: each card is issued for one task. Issuing funds a per-user wallet, so the balance is separate from the user's personal card. Pricing is $5,000/mo plus 1% revenue share.

Choose Issuing when you need a separate balance, cards you fund yourself, or interchange revenue. It does not replace Vault; the two can run side by side.

3. Purchase Agent (done-for-you checkout)

If you do not want to run the checkout yourself, the Purchase Agent does it. Your agent makes one /buy call, or uses the buy tool over MCP, and the Purchase Agent completes the purchase. It covers 18+ merchants and you can be live in an afternoon. Pricing is $0.15 per request and it is free in beta.

4. Why not network tokenization alone?

Network tokenization through Visa Intelligent Commerce and Click to Pay worked for about 8% of cards in our testing. It excludes Chase cards, prepaid cards, commercial BINs such as Brex or Ramp, and anything outside the US. Vault works with any card, so a builder's users are not limited to the 8%.

How Agentcard compares with the usual alternatives

Option	What it is	Where it falls short for agents
Agentcard Vault	The user's own card, swapped in at checkout	Needs a one-time card entry and a Face ID approval per purchase (or an auto approve threshold)
Virtual card numbers	A separate card number issued per use or per task	A separate balance to fund, so points and the user's own dispute path are lost. Agentcard Issuing offers this when you want it
Corporate cards	A shared company card handed to the agent	One card exposes the whole credit line to every agent and retry loop

Crossmint is complementary rather than a competitor, and can sit alongside Agentcard.

Integrations

Agentcard works with Kernel, Browserbase, Browser Use, Anchor, or your own browser. iMessage is supported via Linq and Blooio.

Which to choose

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.