Virtual Cards
for AI Agents.
Works with
Works with
“This is exactly the kind of infrastructure I've been thinking about. Agents need to interact with the real world; payments, APIs, services etc. The plumbing layer for agentic systems is massively underbuilt right now.”
“Super useful framing. Scoped spend limits + agent-specific cards feels like the safest path for real autonomous workflows.”
“On point! There will be a million single person successful companies all over the world some day, all operating through AI agents”
“exactly what i'm looking for since weeks holyy thank uuu”
“Finally, a debit card for AI Agents has come out. I wonder how the legal framework is set up.”
“this is really cool! definitely the right direction for agentic commerce moving forward”
“This is such a smart solution for keeping things secure! Love the idea of giving an agent its own spending limit.”
“Welp, that was fast: totally free* digital card issuer for your agent. Very cool. *: 'during beta'”
Creating AgentCard for $15.00...Card ····4242 created.Completing checkout at namecheap.com...Done. Charged: $12.98.Card auto-closed. $2.02 released back to your balance.Your agent proposes. You approve. That's it.
Connect to Claude, Cursor, or any MCP client. Three commands to get started.
Programmatic card issuance for your agent workflows.
curl -X POST https://api.agentcard.sh/v1/cards \
-H "Authorization: Bearer sk_..." \
-d '{"amount": 1500, "currency": "usd"}'Auto-fills checkout forms when a payment page is detected. Install once, works everywhere.
A pre-authorization hold is placed on your card. Your agent can never exceed this amount.
A single-use virtual card is created instantly. Accepted anywhere Mastercard works online.
After the transaction, unused hold is automatically released. Your real card is never exposed.
Single-use cards. One transaction, then closed.
Human-in-the-loop. Agents propose, you decide.
Pre-auth hold model. Unused amount released automatically.
AES-256-GCM. No passwords — magic link auth only.
AES-256-GCM
PAN and CVV encrypted with a random IV per field. Decrypted only on your explicit request.
Magic links
32-byte cryptographically random tokens. One-use, 15-minute expiry. No passwords ever stored.
JWT HS256
Signed with a 256-bit secret. Stored locally at mode 0600. 30-day expiry.
Per-request JWT
Every MCP request is authenticated with your JWT. No shared credentials between users.
