> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Send a Vault link from anywhere

> Give users the Vault without a frontend: create the link on your server and deliver the URL from a CLI, an email, WhatsApp, or any chat.

A product with no frontend still gets the whole Vault. A CLI, a backend agent, an email flow, a WhatsApp bot: anything that can deliver a URL can send the user to the add-a-card page and the approval page. Agentcard hosts both, with your name and logo in the header.

## Create the add-a-card link

```bash theme={null}
curl -X POST https://api.agentcard.sh/api/v2/vault_sessions \
  -H "Authorization: Bearer $ORG_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

```json theme={null}
{
  "object": "vault_session",
  "id": "vs_2q9d1x8f3k2m4t7w",
  "user_id": null,
  "url": "https://vault.agentcard.sh/v?vs=vs_2q9d1x8f3k2m4t7w.3k1v…",
  "expires_at": "2026-09-16T18:00:00Z",
  "poll_interval": 3,
  "test_mode": false
}
```

Print `url` in the terminal, put it in an email, or drop it in a chat. The user opens it in any browser, types their card, and saves it with a passkey. One link is one enrollment, so send it to one person and bind the `user_id` you receive to them. Sessions last 24 hours by default; pass `expires_in` (60 to 172800 seconds) to change that.

```text theme={null}
Add a card once and your agent can start buying for you:
https://vault.agentcard.sh/v?vs=vs_2q9d1x8f3k2m4t7w.3k1v…
```

If you have no way to reach the user yourself, [`POST /api/v2/checkout/vault_link`](/api-reference/vault/vault-link) has Agentcard text or email a connected user their link.

## Send the approval link

When your agent reaches the payment form, `onApprovalUrl` fires with a link. Deliver it the same way, with what the user is approving:

```text theme={null}
shop.example.com is ready to charge $23.06. Approve here:
https://vault.agentcard.sh/authorize?id=cauth_9k2m…
```

The user opens it, sees the merchant and the amount, and confirms with their passkey. Nobody approving within 15 minutes expires the authorization.

## Put your name on the page

Both pages carry your branding. Set a display name and upload a logo in the dashboard under Settings, General, Branding, and every link you create shows them in the header and the tab title. For a fully dedicated domain, [talk to us](mailto:karen@agentcard.sh).

## Learn when the user is done

Webhooks are the record of what happened:

* `vault.session_linked` carries the `user_id` to store.
* `vault.card_stored` when the card lands in the vault.
* `checkout_authorization.approved`, `checkout_authorization.declined` and `checkout_authorization.expired` for each purchase.

A CLI or an agent with no public endpoint can [poll the session](/vault/adding-a-card#option-b-poll-the-session) instead: read it every `poll_interval` seconds until its `status` is `linked`, then stop.

## Read an expired link

An expired session shows the user a screen that says the link has expired. Your handling is one code path: create a new session and send the new `url`.

## Test it

A sandbox token creates a sandbox session. Open the link yourself, store any of [Stripe's published test cards](https://docs.stripe.com/testing), any future expiry, any CVC, and rehearse a purchase against [shop.agentcard.sh](https://shop.agentcard.sh), a demo store on Stripe test mode.

Next: [Create a cart](/vault/creating-a-cart).