How does it handle unknown prices?

It authorizes at a ceiling and captures at the actual total, so the final charge matches the real checkout amount.

How are card details entered?

Securely into the merchant's own payment fields, with cleartext detokenized just-in-time only at that boundary.

Agent Shopping

Letting AI Agents Shop Online Safely with a Controlled Browser

AgentWallet lets agents complete real online checkouts through a controlled browser with domain allow-listing and an authorize-at-ceiling, capture-at-actual model.

The AgentWallet TeamJune 23, 20261 min read

In short

AgentWallet lets an agent complete a real online checkout through a controlled browser stack. The browser is restricted to allow-listed domains, card details are entered securely into the merchant's payment fields, and spending uses an authorize-at-ceiling then capture-at-actual model so the final charge matches the real total.

Domain allow-listing

A shopping agent does not get to browse the open web with a live card. The controlled browser is restricted to allow-listed domains for the task at hand, which keeps the agent on the sites it is supposed to transact with and off everything else.

Authorize at ceiling, capture at actual

Prices are not always known before checkout, so AgentWallet authorizes at a ceiling and then captures the actual amount. The hold reserves up to the ceiling, and settlement re-prices down to the real total that the checkout produced. The agent gets to complete the purchase without you having to predict the exact price in advance.

The agent opens the merchant checkout in the controlled browser.
A hold authorizes up to the configured ceiling.
Card details are entered securely into the merchant's payment fields.
Settlement captures the actual total and releases the rest of the hold.

Frequently asked questions

Can the agent browse any website?: No. The controlled browser is restricted to allow-listed domains for the task.
How does it handle unknown prices?: It authorizes at a ceiling and captures at the actual total, so the final charge matches the real checkout amount.
How are card details entered?: Securely into the merchant's own payment fields, with cleartext detokenized just-in-time only at that boundary.

Sources

Very Good Security (payment tokenization) VGS
Agentic Commerce Protocol (ACP) OpenAI & Stripe

Give your agents a wallet

Per-agent wallets, virtual cards, USDC on Base, and policy guardrails — provisioned through one MCP endpoint.

Start free