Build1 publisher3 min readPublished
AgentCard now issues a Mastercard token that expires after one purchase
Alchemy's agent credential links back to the user's own Mastercard, and both the user and the issuer can cap it by amount, merchant category and geography before the agent spends anything.
The Engineer · Build desk
What happened
- Both the user and the card issuer can constrain what the agent spends, using transaction limits, merchant categories and geographic rules.
- AgentCard's site says the product is designed to support Mastercard's Verifiable Intent framework, letting each payment carry approved details such as the merchant and the amount.
- AgentCard first launched on June 18th with Visa Intelligent Commerce, using Visa payment tokens beside an email address, phone number and crypto wallet.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- capability A credential spent once and then useless takes the standing secret out of the agent's memory, so a token leaked after the purchase buys nothing.
- exposure The spending posts to a card the user already holds, and Alchemy's announcement leaves the dispute path to whatever the issuer already does, so a misread instruction lands on a human's statement.
- decision A developer who was waiting for an agent-payments standard can defer that choice, because one provisioning call now hands over both a stablecoin wallet and a card token.
- constraint Reach bought through card acceptance means operating inside checkout built for occasional human sessions. That checkout design sets the purchase frequency an agent can plausibly run at.
The containment property is the token's lifespan. AgentCard's Mastercard credentials are tokenized, intended for one-time use, and linked to a user's existing Mastercard, so the credit line, rewards and other benefits stay on the human's account [2]. The token dies with the purchase, so there is nothing to rotate. Limits sit in two places: the user sets them, and the card issuer can set them too, using transaction limits, merchant categories and geographic rules [3].
According to AgentCard's site, the product is designed to support Mastercard's Verifiable Intent framework, so approved details such as the merchant and the amount can travel with the payment [4]. That data is what a merchant, an issuer or a cardholder would use to tell an approved purchase from an agent that misunderstood a request, went over budget or bought the wrong product [5]. Alchemy's announcement does not spell out how disputes, chargebacks or conflicting instructions will be handled in practice [6].
Alchemy says a developer can complete the initial setup through a command-line interface in under a minute [7]. That is a provisioning number. Inside it: an email address, a phone number, a stablecoin wallet and payment credentials [1]. Outside it: the Mastercard account those credentials draw on, because the credential attaches to a card the user already holds [2]. For the minute to transfer to your build, the human's card has to exist first and the four things AgentCard hands out have to be the four things your agent was missing.
AgentCard carries two rails at once. The stablecoin wallet lets an agent interact with emerging payment protocols built for software, while the Mastercard credentials cover online merchants still running on card rails [8]. Runtimewire says the strategy is card networks doing distribution for agentic commerce with stablecoins kept in the stack, a hedge while payment standards for AI agents remain unsettled [14]. Most online checkout systems still expect a person with an email address, a phone number and a card [19]. An agent confined to cards inherits systems built around human checkout sessions and relatively infrequent purchases [15].
"AI agents are quickly moving from simple assistants to software that can take action for people," Viswanathan said in Alchemy's announcement [10]. He said agents need a trusted way to pay, prove authorization and remain inside user-defined limits [11].
AgentCard launched on June 18th with Visa Intelligent Commerce, using Visa payment tokens alongside an email address, phone number and crypto wallet [12]. The Mastercard integration landed 91 days later [17]. Runtimewire counts it as Alchemy's second major card-network integration in three months, and says the addition reduces AgentCard's dependence on a single network [13][18].
Alchemy has sold developer infrastructure since 2017, when Viswanathan and Joe Lau founded it around blockchain applications [16]. The pitch here is one integration instead of assembling identity, wallets and card issuance separately [20]. In my view that trade is worth taking when the alternative is three vendors, and I would want the dispute path documented before real money runs through it.
What to watch
- Whether Mastercard or Alchemy publishes dispute and chargeback rules for Verifiable Intent transactions.
- Whether a third card network or an issuer-side limits API shows up in AgentCard.
- Whether merchants begin flagging agent-originated card transactions differently at checkout.