Mastercard has launched Agent Pay, a new payments infrastructure that lets AI agents make autonomous purchases using virtual, tokenized Mastercard credentials issued through Alchemy's AgentCard platform. The system is live as of September 2026 and allows developers to give AI agents a complete financial identity — including a capped, expiring Mastercard credential, email address, phone number, and stablecoin wallet — via a single command-line interface call.
Agents can now order food, book travel, manage subscriptions, and make other online purchases at any merchant accepting Mastercard, operating within user-defined spending limits and approved merchant lists. Default credentials are capped to a specific amount and valid for seven days, enabling purchases without step-by-step human approval inside those bounds. An experimental "connected" mode also lets agents draw from a user's enrolled Visa or Mastercard via network tokenization, though each purchase in that mode requires a passkey approval locked to a specific merchant and amount.
Confirmed
- Mastercard Agent Pay is live and integrated with Alchemy's AgentCard product, which issues virtual, tokenized, one-time-use Mastercard credentials to AI agents.
- AgentCard provides a CLI that provisions an agent's financial identity in seconds:
npm install -g agentcard,agentcard signup --email [email protected],agentcard setup,agentcard request new --amount 25. - Default virtual cards are single-use, capped at a user-defined amount, and expire after seven days.
- User-defined parameters govern price ranges, approved merchants, and whether the agent must request confirmation before finalizing a transaction.
- Mastercard's Verifiable Intent framework carries user-approved context (merchant, amount) with each payment while the underlying card stays protected.
- On September 10, 2026, Ant International, Mastercard, and Visa announced the Know Your Agent (KYA) interoperability framework, building on Visa's Trusted Agent, Mastercard's Verifiable Intent, and Ant International's Agentic Mobile.
- KYA aims to enable cross-network operator traceability, shared certification requirements, and continuous transaction monitoring with revocation capability.
Unknown
- General availability timeline and geographic rollout scope for Agent Pay beyond the current live integration.
- Pricing model for issuers, merchants, or developers using the Agent Pay rails (AgentCard itself is free to start with no subscription; users fund each card as they use it).
- Independent security audits or red-team results for the AgentCard CLI, Verifiable Intent payloads, or KYA certification process.
- Whether the experimental "connected" mode (drawing from enrolled Visa/Mastercard via tokenization) will graduate to general availability and under what SLA.
- Regulatory status of KYA as a potential reference for anti-money-laundering or KYC obligations.
Our take
Mastercard is inverting its core function — built to block bots — to now authenticate and authorize them. The bet is that verifiable intent, tokenized credentials, and cross-scheme KYA can replace human approval without enabling abuse. The open question: whether revocation and behavioral auditing can scale once agent commerce moves beyond developer sandboxes.
