Skip to main content
Two safeguards gate sensitive actions on a personal account: a one-time identity check before your first card, and approval requests for high-trust actions.

​
One-time KYC

Before you can create your first card, the card issuer requires basic identity information. The first create_card call returns user_info_required — collect:
  • First name and last name
  • Date of birth
  • Phone number
  • Acceptance of the Stripe Issuing cardholder terms
The agent-cards cards create flow prompts you for these the first time.
You only do this once.

​
Approval requests

Some high-trust actions — such as revealing full card details (get_card_details) or certain spend — can trigger an approval request (HTTP 202). When that happens:
  1. An email is sent to the account owner.
  2. The owner approves from the email.
  3. Your agent calls approve_request with the approval ID (or you approve from the link), then the original action proceeds.
Authorization is always enabled on your account; you can review its status with agent-cards settings authorization.

​
Other gating responses

ResponseMeaningWhat to do
user_info_requiredFirst-time KYC not yet submittedSubmit identity info, then retry.
approval_required (202)Action needs owner approvalApprove from email, then approve_request.
payment_method_requiredNo saved payment methodRun setup_payment_method first.
beta_capacity_reached (403)You’ve been waitlistedWait — nothing else to do.

​
Security defaults

  • Card numbers and CVVs are never shown unless you explicitly request them.
  • Closing a card is always confirmed (it’s irreversible).
  • Switching to prod mode is always confirmed (prod cards draw on your real payment method).