Skip to main content
Save a real card once, Crossmint tokenizes it, and you create virtual cards with their own limits for your agentsSave a real card once, Crossmint tokenizes it, and you create virtual cards with their own limits for your agents
Your user saves their real card once. From that card, you create as many scoped authorizations as your agents need, each with its own limit, purpose, and expiration. Crossmint calls these order intents. From an order intent, the agent mints a credential on whichever rail the purchase needs, and pays without ever seeing the real card number. For the problem this solves and how it compares to other approaches, read How Agents Pay.

​
Key Features

Save once, authorize many

One saved card backs any number of scoped agent cards

Scoped by design

Every agent card has an amount, a purpose, an expiration, and optionally a merchant

Enforced by the network

Visa Intelligent Commerce and Mastercard Agent Pay hold the limit, not your code

Real card never exposed

Agents receive one-time or encrypted credentials from a PCI-compliant vault

Multiple rails

Network tokens, encrypted card, and protocol credentials such as SPT from the same authorization

Revocable

The user cancels an agent card or deletes the saved card at any time

​
How It Works

1

The user saves a card once

Your app renders a Crossmint-hosted secure iframe. The card goes straight into Crossmint’s PCI-compliant vault and never touches your servers.
2

You create scoped agent cards from it

Each agent card is an order intent: an allowance with an amount, description, expiration, and optionally a merchant. Create one per agent, per task, or per purchase. The user approves it with a passkey or a network-hosted step, and can cancel it at any time.
3

The agent pays on the right rail

From an approved agent card, the agent mints the credential the purchase needs: a one-time card number bounded by the allowance, an encrypted card for cards outside the network programs, or a protocol credential. A network-issued credential is bounded to the allowance, expires, and is revoked with the agent card. The encrypted card is the saved card itself, so keep the purchase within the allowance and cancel the agent card when it is no longer needed.

​
Rails

One agent card can mint credentials on several rails. Pick the rail the purchase needs; the rest stay unused. Depending on the rail, the credential is delivered as a one-time card number, a network token, or a protocol-specific format such as MPP.

​
Get Started

Quickstart

Run the reference app: sign in, save a card, authorize an agent card, and mint a credential

Try the live demo

See the full flow without setting anything up locally

​
Guides

Save a Card

Collect a user’s card in a PCI-compliant iframe

Register a Card

Discover the rails a saved card supports

Create an Agent Card

Create and authorize a scoped order intent

Retrieve Secure Card Numbers

Mint a credential from an approved agent card

Customize UI

Style the approval modal to match your brand

Cancel Card Access

Cancel an agent card or delete a saved card

​
API Reference

Payment Methods

Create, list, and delete saved cards

Order Intents

Create, mint credentials from, and revoke agent cards

​
FAQs

No. The agent receives a one-time card-network credential minted for a specific amount, or, when no network rail is available, a copy of the saved card encrypted to a key the agent controls. The real card stays in Crossmint’s PCI-compliant vault.
Yes. Every purchase runs on the user’s own card, so the card’s normal protections apply. Nothing is prefunded and no new account is opened.
The agent card includes an encrypted-card rail. Minting from it returns the saved card encrypted to a public key you supply, so the agent can still pay while the card details stay out of transit logs. In production this rail is available only for projects with encrypted card access enabled.
Yes. Agent Checkouts accepts any method the merchant supports, and a Crossmint Agent Card is the recommended one. See Choose a Payment Method.