Skip to main content
Every authenticated request in a company integration goes through the Agentcard MCP server, with the user’s OAuth access token: 
POST https://mcp.agentcard.sh/mcp
Authorization: Bearer <access_token>
Accept: application/json, text/event-stream
It’s a standard MCP server over Streamable HTTP: initialize → notifications/initialized → tools/list → tools/call, echoing the Mcp-Session-Id header. Any spec-compliant MCP client handles this for you — point it at the URL with the token from the OAuth flow and the tools load automatically.

​
Expose the tools dynamically

Register every tool tools/list returns instead of hardcoding names. Tools Agentcard ships later then appear in your integration with zero code change. If you ever need a denylist, make it config-driven and default it to empty.
By default the granular shopping tools aren’t advertised in tools/list — the conversational buy tool covers the whole shopping flow. They remain callable by name; each tool page says which group it’s in.

​
Approval gates

Sensitive calls can pause for explicit approval. When create_card or get_card_details returns a status of approval_required with an approval_id, nothing has happened yet — resolve it with approve_request. Auto-approve when the user just asked for the action; confirm with them first before revealing card credentials.
get_card_details returns the full card number and CVV. Never write these to logs, error reports, or analytics.
Whether those cards are live or test is set by the OAuth client your app connected with: a sandbox client mints test cards (no real charge), a production client mints live cards (which requires an active subscription). See Production.

​
Funding and KYC

Cards are funded from the user’s Agentcard wallet. If create_card reports that KYC or wallet funding is needed, relay the message to the user — they complete it in their own account — then retry. If a deposit is still confirming, wait the suggested interval and retry.

​
Card isolation

A token from your client only sees the cards your app created for that user. It can’t touch the user’s personal cards, another app’s cards, or another user’s anything. A brand-new connection listing zero cards is expected — not a bug.

​
The tools

Browse the sidebar for every tool — each has its own page with parameters, returns, and an example call. The ones you’ll use most: create_card, get_card_details, list_cards, check_balance, close_card, and approve_request.