Skip to main content
An issued card works like any card: your agent types the number, expiry and CVC into a merchant’s checkout. What is different is what happens around it. Credentials are revealed on demand, single-use cards close themselves, and every charge reaches your server as a webhook.

​
Read the credentials

Ask for them when the agent is at the payment form, not before:
The full number and CVC are in the tool’s text result. Never write them to logs, error reports, or analytics. Prefer get_card_balance when you only need the balance. If the response is approval_required, the user has asked to approve each reveal. Show them the prompt, they approve from their own Agentcard session or the emailed link, and your agent retries with the approval_id.

​
Pay

Type the credentials into the checkout. The card authorizes up to its amount_cents, and declines anything above it or outside a merchant lock. Your server receives transaction.authorized when money moves and approval.requested when a purchase needs a human first. For merchants Agentcard already covers, your agent can skip the browser: the buy tool on the same MCP connection runs the purchase conversationally and pays with the card. See the Purchase API.

​
What happens after a charge

  • Single-use cards close themselves after the first approved charge. closed_reason is used.
  • Multi-use cards stay open until their limit is spent or you close them.
  • Refunds post back to the card that paid. The balance returns to the user.
  • Tokenback: settled spend earns tokens, 1 token per cent. get_rewards shows them, redeem_rewards turns them into spending power.

​
Manage a card

Multi-use cards can be managed while open: list_cards shows every card the connection can see, with test cards flagged.

​
Webhooks

Register a webhook endpoint and subscribe to what you need: React to webhooks, not to the conversation. The agent saying it paid is a claim. transaction.authorized is a fact.

​
Sandbox

Test cards are issued instantly, carry credentials, and are not accepted by real merchants. Use them to exercise your agent’s checkout code against a test storefront such as shop.agentcard.sh on Stripe test mode. The reveal, close and webhook flows are identical to live.