Skip to main content
Two safeguards gate sensitive actions on a personal account: a one-time identity check before your first card, and approval requests for high-trust actions.

​
One-time KYC

Before you can create your first card, the card issuer requires identity verification. It runs in the conversation: you share a photo of your government ID (driver’s license, state ID, or passport), the details are read off it automatically, you confirm them, and the only browser step is a short face scan at the end. You’re never asked about occupation, income, or spending plans. The flow, in order:
  1. ID photo — your agent asks for a photo of your ID (a file path, or a secure upload link that works with a phone camera). The verification provider reads the printed fields off the document automatically; you review and confirm every value before anything is submitted.
  2. Whatever the ID didn’t carry — usually just your SSN (IDs don’t print it) and a phone number. The SSN goes straight to the verification provider and is never stored by Agentcard.
  3. Terms — one explicit yes to the card issuer’s cardholder terms.
  4. Face scan — a link opens a short selfie check in your browser. Verification usually completes in about a minute, and your agent picks up right where you left off.
Run agent-cards kyc (or just agent-cards cards create — it walks you through verification the first time).
You only do this once.
Rejected because your documents are already verified on another Agentcard account? Re-submitting them can never fix that. Link the other account instead and your verification carries over: see Linking accounts.

​
Approval requests

Some high-trust actions — such as revealing full card details (get_card_details) or certain spend — can trigger an approval request (HTTP 202). When that happens:
  1. An email is sent to the account owner.
  2. The owner approves from the email.
  3. Your agent calls approve_request with the approval ID (or you approve from the link), then the original action proceeds.
You can also review and resolve everything waiting on you from the CLI:
All three take --json for scripts (approve --json requires -y, since approving records your consent). Authorization is always enabled on your account; you can review its status with agent-cards settings authorization.

​
Other gating responses

​
Security defaults

  • Card numbers and CVVs are never shown unless you explicitly request them.
  • Closing a card is always confirmed (it’s irreversible).
  • Every card has a fixed spend limit, so it can never draw more from your wallet than the amount it was created with.