# Agent card: one-time virtual cards for AI agents, explained

What an agent card is: a one-time or capped virtual card an AI agent pays with. Who issues them, limits, 3D Secure, and why single-use cards fail later.

## Summary

An agent card is a payment card an AI agent can use without seeing your real card number. Most are one-time or capped virtual cards: the agent asks for a card for one purchase, a person or a rule approves it, and the card works for that amount and then stops. They let an agent pay an ordinary checkout page, such as an API seller's.

A note on the name: in Google's Agent2Agent protocol, an "Agent Card" is a JSON file that describes what an agent can do. That is a different thing. This post is about paying. It covers who issues agent cards, how they work, their limits, 3D Secure, and why a single-use card cannot pay a later charge. Facts come from each issuer's page, read on 2026-10-14.

Note: What looot accepts today: a prepaid balance paid on a Stripe-hosted Checkout page. A person pays, or forwards the link: the agent never enters card details. An agent card pays our Checkout page as a card (untested): we have not run one there yet. Setup is on [Pay looot from your agent](https://docs.looot.ai/money/pay-from-your-agent).

## Who issues an agent card

These five issuers publish agent card products on their own pages. Our [agentic payments roundup](https://looot.ai/blog/agentic-payments-how-an-ai-agent-pays-for-an-api) ranks them with the protocols.

| Issuer | What the agent gets | Who approves |
|---|---|---|
| Stripe Link | A one-time card or a shared payment token | You, in the Link app, for each request |
| AgentCard by Alchemy | A one-time number, or a Mastercard or Visa network credential | No step for one-time numbers, a passkey for Mastercard Agent Pay |
| Slash | Virtual or physical cards made over MCP | A team member, when the key is read-only |
| Ramp | An Agent Card for browser checkout | The fund's approval policies |
| Crossmint | Virtual cards through Visa Intelligent Commerce | Rules you set, with approval above a threshold |

[Agentcard](https://agentcard.sh) at agentcard.sh is a different company from AgentCard at agentcard.ai. It issues Visa cards through Rain and stores real cards for platforms, and it says it chose stored cards because "one-time cards needed KYC for everyday purchases, and users refused it".

## How a one-time agent card works

AgentCard's skill page gives the plainest example. Its one-time number is "capped to the purchase amount, live for 7 days, funded by a hold on the user's saved card", with no approval step. The agent puts that number into the checkout like any card. The merchant sees a normal card payment.

Link works the same way with a person in the loop. The agent sends a spend request with the merchant and amount, you approve it, and Link returns a one-time card. Stripe says the agent never receives your real credentials.

## Single use virtual card vs a capped card

A single use virtual card is closed after one charge. A capped card stays open but stops at a limit. The issuers split this way:

- **Single use:** Link's one-time card and AgentCard's one-time number. One purchase each.
- **Capped and reusable:** Slash lets you set limits "per card or card group", per day, per month or for the card's lifetime. Agentcard at agentcard.sh offers "hard spend limits, transaction-count limits, and merchant or merchant-category (MCC) restrictions".

Use a single use card for a one-off purchase you can see. Use a capped card for a seller the agent pays again and again.

## Limits of agent cards to plan for

- **Amount caps.** AgentCard caps one-time numbers at $150 during beta and direct accounts at $200 a day ([AgentCard skill page](https://agentcard.ai/skill), read 2026-10-14).
- **KYC.** AgentCard asks new direct accounts to verify identity before any spend.
- **Network tokens do not cover every card.** Agentcard says Visa Intelligent Commerce and Click to Pay "only worked for about 8% of cards" in its tests.
- **Approval.** Link asks a person for every request today. Spending limits that skip approval are planned, not available yet.

## 3D Secure on agent cards

3D Secure is a check the card's bank may add at checkout. Stripe's docs say "the issuing bank might request cardholders to authenticate", by password, a one-time code sent to their phone, or biometrics ([Stripe 3D Secure docs](https://docs.stripe.com/payments/3d-secure)). An agent cannot read your phone. AgentCard says its skill "handles checkout 3DS challenges". The other issuer pages we read do not say how they handle it. Expect some agent card payments to stop and wait for a person.

## Why a single-use card fails later charges

Some sellers save the card from the first payment and charge it again later, for a renewal or an automatic top-up. A single-use card is closed after its first charge, and AgentCard's one-time numbers expire after 7 days. Any later charge to that card will be declined. If the agent pays a seller more than once, give it a capped reusable card, or let a person top up a prepaid balance. We have not tested this on looot's Checkout either, so the docs page will say what we see.

## What it cannot do

An agent card pays checkout pages that take cards. It does not answer an x402 or MPP payment request: those need a wallet or a shared payment token, covered in the [MPP explainer](https://looot.ai/blog/machine-payments-protocol-stripe-mpp-explained). It does not remove the person entirely: someone saves the card, passes KYC or approves the spend. On looot, an agent card is untested, and the agent still needs a Checkout link paid once. Last checked 2026-10-14.

## Try it

For other ways to fund an agent, see [prepaid balance for AI agents](https://looot.ai/blog/mcp-server-with-one-prepaid-balance).

## Questions

### What is an agent card?

An agent card is a virtual payment card an AI agent can use without your real card number. Most are one-time or capped, and a person or a rule approves each spend.

### Is an agent card the same as an A2A Agent Card?

No. In Google's Agent2Agent protocol, an Agent Card is a JSON file that lists an agent's skills. A payment agent card is a virtual card for purchases.

### Are AgentCard and Agentcard the same company?

No. AgentCard at agentcard.ai is a CLI from Alchemy for one-time cards. Agentcard at agentcard.sh issues Rain cards and stores cards for platforms.

### Can an agent card pass 3D Secure?

Sometimes. The bank may ask the cardholder for a code or a biometric check. AgentCard says its skill handles 3DS challenges. Otherwise expect the payment to wait for a person.

### Why would a single use virtual card be declined later?

It closes after one charge. A seller that saved it for a renewal or an automatic top-up cannot charge it again.

### Can I pay looot with an agent card?

We expect it to work on our Checkout page as a normal card, but we have not tested it. Use a reusable card if you want later top-ups.

### Which agent card needs the least setup?

Link's wallet for agents, if you already use Link: connect the agent, then approve each request. AgentCard needs an install, a saved card and KYC first.

## For agents

### Let your agent ask before it spends

```text
Use looot to verify the email address support@stripe.com. First set up https://looot.ai/skill.md. Read the price and my balance before the run. If the balance is too low, call top_up and send me the Checkout link to pay. Do not enter any card number yourself.
```