Skip to main content
Let the user bring their own card. Your backend asks Agentcard for a secure link; the user opens it and adds their Visa in about a minute — a one-time code from their bank plus a passkey. From then on, every single-use card the agent creates charges the user’s own card directly: no identity verification (KYC) and no balance to fund, which is what makes this the fastest path to production. Multi-use cards are the one exception — they stay balance-funded (and multi_use + connected_card_id is rejected), so keep the balance/KYC flow if your integration issues them. The card number is entered on the hosted page only — it never passes through your servers.
Over MCP: once the user is connected, their agent can run this same flow itself with the attach_card tool; list_attached_cards and remove_attached_card manage the enrollments, and create_card picks one with connected_card_id.

​
Instructions for your agent

Paste this into your coding agent to implement the attach flow. It assumes the user is already connected (you have their user_id — see user authentication).
Instructions for your agent

​
How it works

  1. Your backend calls POST /api/v2/attach for the connected user and gets back a secure, single-purpose link (valid 48 hours).
  2. The user opens the link and adds their card on the hosted page — card details, a one-time code from their bank, then a passkey. You build nothing for this step.
  3. Your backend polls GET /api/v2/attach until it reads active, with the card’s brand and last4.
  4. From then on, create_card automatically mints against the attached card — purchases charge the user’s own card, and the KYC and balance-funding steps never come up.

​
The flow

1

Start the attachment

POST /api/v2/attach with the user_id. You get pending with an attach_url — hand that link to the user.→ Start a card attachment
2

The user completes the link

About a minute in their browser: card details (entered on the hosted page only), a one-time code from their bank, and a passkey. The page is hosted by Agentcard — you build nothing.
3

Confirm

GET /api/v2/attach?user_id=…. active means done; pending means nudge the user to finish the link.→ Get the attachment status
4

Spend

create_card now mints against the attached card automatically — continue to MCP integration to give your agent the full toolset.
Eligibility. Attachment supports the user’s own consumer cards: US-issued Visa cards, and Mastercard from any country. Some issuers and all business cards are excluded, and a card’s issuing bank must support the network’s agent verification. When a card is ineligible or attachment is unavailable, fall back to the card creation flow — balance funding plus create_card.
No KYC, but not anonymous. The issuing bank already verified the user, so Agentcard runs no identity check — but a phone number and recorded consent are still required once (user_info_required names the missing pieces, each with a v2 endpoint to collect it).