Agent Vault for Cards

Give your agent a card it can't leak.

Your real payment details stay with us. Your agent gets mock tokens that work at checkout. Credit cards never enter the agent context, logs, or memory.

shopping-agent.ts
// agent context
card: av_card_1_number_u7x2k
name: av_id_first_name_u7x2k
zip: av_addr_bill_zip_u7x2k
> page.click('#pay')
Shopping Agent
$142 / $200 weekly
AV
4242 .... .... 4242
VISA
Checkout - example.com
awaiting agent
Card number
-
Cardholder name
-
Billing zip
-
CVV
-
Never
Card in agent context
15 min
Mock token expiry
Per card
Spending limits + allowlists
1 import
To switch from Playwright
Agent Vault

A vault for agents that handle secrets.

Agent Vault holds the secrets your agent has to use but should never see. Your agent works with mock tokens, and our proxy swaps them for the real values inside a session it can't see. Cards and logins are live today, and both work exactly that way.

Cards

Give your agent a card it can't leak.

  • Mock card tokens fill any checkout form. The real number never enters the agent.
  • Per-card spending caps, merchant allowlists, and a kill switch.
  • One Playwright import, no other changes to your agent.
Open Cards Learn more

Logins

Give your agent a login it can't leak.

  • Mock username and password tokens sign in. Real credentials stay vaulted.
  • Save a login per site, swapped in only at the moment of submit.
  • Same proxy and isolation as Cards, one vault for both.
Open Logins Learn more
The problem

The problem in 30 seconds.

An agent browses a page. The page contains injected instructions. The agent dumps its context to an attacker-controlled endpoint. If your card number or your password was in that context, it's gone. Agent Vault exists to keep those secrets — cards and passwords alike — out of the agent in the first place.

Without Agent Vault
Agent context
{
"card_number": "4242 4242 4242 4242",
"cardholder": "Taylor Chen",
"cvv": "823",
"billing_zip": "94105"
}
With Agent Vault
Agent context
{
"card_number": "av_card_1_number_u7x2k",
"cardholder": "av_id_first_name_u7x2k av_id_last_name_u7x2k",
"cvv": "never stored; live entry coming soon",
"billing_zip": "av_addr_bill_zip_u7x2k"
}

If the agent is compromised, the attacker gets mock tokens. They only work through our proxy, and a proxy session times out after 15 minutes idle. They cannot make a purchase or sign in anywhere else, and you can revoke a card or login at any time.

How it works

Four steps. Change one import.

The same flow covers cards and logins. If your agent uses Playwright, it works with Agent Vault. The rest is config in the dashboard.

How a checkout flows through Agent VaultYour agent holds only mock tokens and never sees a real credential. It sends those tokens across the proxy boundary to the Agent Vault proxy, which authorizes the fill and passes an opaque card token to an enclave. The enclave, the only place the real card is ever revealed, looks the card up in the PCI vault and types it into the checkout in its own browser. That browser's network traffic is tunnelled back out through your own machine, which relays it onward. Tunnelling is on by default, so the merchant usually receives an ordinary card transaction from your IP rather than our cloud; if a tunnel cannot be established the session falls back to egressing from our cloud IP instead.UNTRUSTED - AGENT-VISIBLETRUSTED - ISOLATEDPROXY BOUNDARYYour agentPlaywright - LLMmay be prompt-injectedMock tokensav_card_1_number_u7x2kav_id_first_name_u7x2kAgent Vault proxysession - policynever holds the cardPCI vaultreal cardtokenized at restConfidential Compute enclavecard revealed only heredrives the checkout in its own browserYour machinetunnel exit - your IPon by default - relays your trafficMerchant checkoutan ordinary card transactionfrom your IP by defaulttokens ->card tokenlookupcardtunnelled egressout from your IP ->
01

Store your secrets once, in the dashboard

Cards go in the Cards vault, logins in the Logins vault. Card numbers are tokenized to Basis Theory (a PCI-DSS Level 1 vault), so we hold only a token, never the number; logins sit encrypted. Nothing leaves until a proxy session needs it.

// dashboard
Card added
  brand: Visa
  last4: 4242
  exp:   09/28
Login saved
  site:  github.com
02

Scope each agent's access

Give a shopping agent a card with spending caps and a kill switch; give a research agent just the logins it needs. API keys are issued separately per agent.

POST /v1/virtual_cards
{
  "name": "Shopping Agent",
  "card_id": "card_1",
  "weekly_limit": 200,
  "per_txn_cap": 75
}
03

Your agent uses mock tokens when filling forms

Card fields and login fields both become tokens that look real but carry no value. A compromised agent can leak them all day.

await page.fill('#cc',   'av_card_1_number_u7x2k');
await page.fill('#name', 'av_id_first_name_u7x2k');
await page.fill('#user', 'av_login_github_username_u7x2k');
await page.fill('#pass', 'av_login_github_password_u7x2k');
04

Real values are substituted at the last moment

A card number is revealed and typed inside the enclave; the proxy only ever forwards an opaque token. Login passwords are substituted in the proxy's own isolated session. Either way the agent cannot observe it, and the merchant or the site sees a normal request.

// inside the enclave: the proxy only ever held a token
const pan = await vault.detokenize(cardToken);
await page.fill('#cc', pan);
// merchant sees: 4242 4242 4242 4242
Security model

What the agent can't reach, it can't leak.

The same three controls cover everything in the vault. Whether it is a card number or a password, the agent is isolated from real values, from other sessions, and, for cards, from its own spending ceiling.

The agent never sees the card

Mock tokens in the agent's context, real numbers in ours. Substitution happens inside a proxy the agent cannot observe or script.

Per-card spending limits

Agent cards have daily, weekly, monthly, and per-transaction caps. Optional merchant allowlists. Auto-pause on any limit exceeded.

Session isolation

Each agent session runs in its own browser context. Cookies, storage, and cache do not cross between sessions. Tokens are single-use and expire in 15 minutes.

Three layers. The agent only ever touches the top.
Use cases

Built for agents that need to transact and sign in.

Any workflow that ends in a checkout form or a sign-in form works. You decide which agent gets which card and which logins, and how much it can spend.

Shopping Agent
$142 / $200 this week
AV
.... 0742
VISA
Research Agent
$28 / $100 this week
AV
.... 1183
VISA
Procurement Agent
$86 / $500 this week
AV
.... 5520
VISA
Personal shopping agents
"Book me a flight under $400." Keep the agent to a weekly cap.
Research agents
Buy reports, data access, or paywalled papers on demand.
Dev tools
Purchase API credits when a rate limit is hit mid-pipeline.
Procurement agents
Small teams that let an assistant handle recurring orders.
Pricing

Start free, scale when you're ready.

Three tiers: begin on Free, then step up to Plus or Pro as your agents do more. Upgrade anytime from your dashboard. Compare what each tier includes below.

Free
$0/month

Everything you need to give one agent a card with sensible defaults.

Get started
Pro
$20/month

The highest volume, unlimited agent cards, and merchant allowlists.

Choose Pro
FeatureFreePlusPro
Payments per month21030
Agent cards15Unlimited
Daily spend limitsYesYes
Merchant allowlistsYes
Webhook notificationsYesYes
Email supportYesYes
Priority supportYes
Compatibility

If it uses Playwright, it works.

One drop-in import covers the whole vault: the same swap fills card fields at checkout and credential fields at sign-in. Keep the rest of your agent code.

1
import { chromium } from '@agentvault/playwright';
one import change
 
3
const browser = await chromium.launch();
4
const page = await browser.newPage();
5
await page.goto('checkout.example.com');
 
7
await page.fill('#card', 'av_card_1_number_u7x2k');
mock card token
8
await page.fill('#name', 'av_id_first_name_u7x2k');
mock identity token
9
await page.fill('#zip', 'av_addr_bill_zip_u7x2k');
mock address token
10
await page.click('#pay');
proxy substitutes ->
Before
Playwright
import { chromium } from 'playwright';

const browser = await chromium.launch();
const page = await browser.newPage();
await page.goto(url);
await page.fill('#card',  CARD_NUMBER);
await page.fill('#name',  CARDHOLDER);
await page.click('#pay');
After
Agent Vault
import { chromium } from '@agentvault/playwright';

const browser = await chromium.launch();
const page = await browser.newPage();
await page.goto(url);
await page.fill('#card',  'av_card_1_number_u7x2k');
await page.fill('#name',  'av_id_first_name_u7x2k');
await page.click('#pay');
Tested agent frameworks
Claude Code
Anthropic's CLI agent
OpenClaw
Open-source agent runtime
Playwright scripts
Plain Node + browser
Computer Use
Anthropic's browser tool
Open source

Most of the web speaks no agent protocol.

On the long tail of stores, agents still fail at the boring parts: carts that silently no-op, payment iframes, wallet-button traps. The Checkout Recipe Registry is a community catalog of per-platform and per-merchant checkout recipes: machine-readable JSON with a schema, a validator, and an autonomy benchmark. Any Playwright agent can read it, with or without Agent Vault.

A recipe
verified
{
  "id": "brushespack.com",
  "kind": "merchant",
  "hosts": ["brushespack.com"],
  "platform": "woocommerce",
  "status": "verified",
  "lastVerifiedAt": "2026-06-22",
  "evidence": "Order #681199, $2.00, merchant email receipt",
  "cardSurface": "stripe-payment-element",
  "cvvTarget": "payment-frame:input[name=cvc]",
  "gotchas": [
    "Set #billing_country FIRST — it AJAX-refreshes.",
    "Below the Stripe minimum, no card frame mounts."
  ]
}
Reading it
GET /v1/recipes
// Prefer the Playwright drop-in: it strips the query, the
// fragment, and any hosted-checkout token before lookup. Pass
// the URL you navigated to — SdkPage has no url() getter.
import { recipesForUrl } from '@agentvault/playwright';

const { merchant, platform } = await recipesForUrl(productUrl);

// Or plain HTTP — public, unauthenticated, no account needed.
// Send only scheme://host/path, never a session token:
// GET /v1/recipes?url=https%3A%2F%2Fbrushespack.com%2Fproduct
Browse the registry Read the schema
Agent Vault for Logins

The same protection, now for sign-in.

Logins applies the card model to credentials. Save a username and password once, and your agent signs in with mock tokens. Your real credentials never enter the agent's context, so a prompt injection can't leak them.

LoginsWhat the agent sees when it fills a sign-in form

The proxy swaps each token for the real value inside an isolated session, at the moment of submit. Add your logins from the Logins tab in the dashboard.

Questions

Things people ask.

If something is missing, write to us. We answer honestly, including about what we don't have yet.

It gets a mock token it can leak all day. The real card number was never in the room. Mock tokens expire in 15 minutes and only work through our proxy, so they have no value outside a short window and a specific session.
Card numbers live in Basis Theory, a PCI-DSS Level 1 certified vault. We store only a tokenized reference, and the number is revealed solely inside our Confidential Compute enclave, never in our app or database.
A normal transaction with a real card number and a real billing address. They do not know a proxy was involved. There is nothing unusual for their fraud detection to flag.
Yes. Pause an agent card on its detail page or hit the kill switch on the Overview. Pending proxy sessions fail their next substitution attempt. Unpause when you want the agent back.
Set a per-transaction cap and a weekly limit when you create the agent card. You can require confirmation above a threshold. If the agent goes over, the card auto-pauses and you get a notification.
Yes. The Playwright drop-in works identically in headless mode. CI credentials live in env vars alongside your existing secrets.
Bank virtual cards stop fraudulent charges. This stops the card number from ever entering the agent's context. If your agent is compromised, a bank virtual card still leaks the number. A mock token does not.
No, your card number is tokenized directly to Basis Theory (a PCI-DSS Level 1 vault) from your browser, so it never touches our servers. We store only a token reference; the number is detokenized only inside our enclave to fill a checkout.