Introducing a universal vault for agent cards: The best way to provide cards to agents

Today, we’re introducing a universal vault for agent cards.

Agents are earning our trust one task at a time. Each product search, price comparison, reservation, and purchase is building confidence in the ability for agents to discover and buy on our behalf. Allowing agents to spend with cards safely and easily is the next big step towards a future where every human is helped by agents to buy smarter, faster, and more responsibly. 

Crossmint is the only company with a complete white-label model for supporting these card purchases in the right way for agent builders. 

Every agent developer would like three things when equipping agents to spend with cards:

1. Can I fully own the onboarding experience without needing to go to a third-party site?
2. Can I ensure cards being stored and used by agents are secure and compliant?
3. Can I support the various cards my users want to use?

We built a solution to address all of these needs. Crossmint’s universal vault for agent cards is an SDK that enables agent developers to collect any card your users provide inside your own product, store it securely in a PCI-compliant vault, and let your agent spend from it.

We’ve been building payment infrastructure for agents since 2024, starting with wallets and then cards, and have years of experience in payment infrastructure for various digital goods. 

One thing we have learned first hand is the importance of creating a simple, easy experience for users. It is critical to keep your users in your product. Every third-party redirect, widget, or interface equates to a drop-off in your user base, leading to lost transactions and users. On top of that, adopting the emerging agentic protocols like Mastercard Agent Pay and Visa Intelligent Commerce enables the most complete solution for agent platforms to make their agents commerce-ready.

Drawbacks with a link to a third party site

Currently the best available option for agent developers is to collect cards through a 3rd party hosted payment link. Once users have an account and a card saved, they can issue virtual cards to hand to their agent for one time use. However, this approach adds steps, takes users out of the product, and creates an additional virtual card that limits transaction visibility and rewards.

Online stores went through this once already. Early stores sent shoppers to PayPal or to the payment gateway's hosted page to pay, so the shopper crossed to another company's site to finish a purchase. Embedded card fields ended that, boosting conversion for every store on the web. The processor still handled the raw card number, but the entry form sat on the store's own page, so merchants kept checkout on their site without taking on PCI scope.

In today’s world of agents, agents need a sort of “PSP” of their own, only this time it is a way for agents to receive access to a variety of payment methods. The closer the experience is to embedded in the agent’s surface area, the better the utility and experience will be for most users. 

Card entry that stays in your product

With Crossmint, you collect the card through our SDK component. It renders inside your UI (or perhaps even in an app extension), sends the card straight to a PCI vault, and returns a token. Your user never leaves your product, and your servers never touch the card number, so you stay out of PCI scope.

Users enter the card in your product, under your brand, the same way a shopper at an on-site checkout never learns which vault holds their card. Once a card is in the vault, what your agent gets back depends on whether that card is enrolled in one of the emerging card network programs.

Card networks are building new, specialized protocols to improve security and access for agents to cards. Notably, we have been the first to integrate with Visa Intelligent Commerce and Mastercard Agent Pay, and if we can help developers access these agentic commerce networks, that’s our first priority. These protocols provide a better way to connect the buyer's agent with the merchant's checkout in a way that passes intent and data that is essential to scaling up agentic commerce.

{  
  "id": "card_01J8K3M2P7Q",  
  "last4": "4242",  
  "brand": "visa",  
  "credentials": ["visa_intelligent_commerce", "encrypted"]
}

Request visa_intelligent_commerce and you get a scoped virtual card. Request encrypted and you get the stored card for checkouts that need the number.

If a given card is eligible, we tokenize it (a specific action the card networks are investing in for agentic commerce) with these new protocols. When the agent needs to pay, it receives a one-time credential linked to the user's card, with an expiration date and a spend limit the user sets. The agent never handles the real card number, so a leak from a browser session or a log exposes one scoped credential and nothing else. Critically, no agent developer or user has to worry about what is happening behind the scenes and whether or not a specific card works with VIC or Agent Pay. 

At Crossmint we’ve also developed a way for agents to securely execute purchases using any card by pairing that card with our Agent Checkout product. Still in pre-release, Agent Checkout is the most secure, cheapest, and best way to let agents buy across the web. Agent Checkout lets developers choose how they want to let agents execute transactions: browser automation to fill out a checkout form, using a merchant API, or leveraging an agentic commerce protocol. Importantly, regardless of the checkout path, tokenized card credentials keep you out of PCI scope. We will share more details on Agent Checkout in the coming days.

For services paid over HTTP, Crossmint also supports x402 and Machine Payments Protocol (MPP) from the same account, so an agent can buy an API call the same way it buys a pair of shoes.

Start building

Our universal vault for agent cards is live today, you can find docs are here. If you’re building agents or agent infrastructure and want to offer Agent Cards to your developers, contact us at agents@crossmint.com.