Mastercard Agent Pay is Mastercard's program for letting artificial intelligence (AI) agents make card payments on behalf of consumers and businesses. Announced on 29 April 2025, it requires agents to be registered and verified, pays with Mastercard Agentic Tokens instead of real card numbers, and lets the cardholder set what an agent may buy. Issuers, merchants and the network can all see that an agent took part in the transaction.
Agent Pay is Mastercard's entry into agentic commerce and the counterpart of Visa Intelligent Commerce, which Visa announced the next day. It works at the card-network level, beneath checkout protocols such as the Agentic Commerce Protocol (ACP) and the Agent Payments Protocol (AP2), and should not be confused with Mastercard's consumer wallet products or with Mastercard Send.
Mastercard Agent Pay in plain terms
Think of a company car with a fuel card. The driver can fill up, but the card only works at petrol stations, only up to a set amount, and every receipt shows which driver used it. Nobody needs to hand the driver the company's bank details, and if the card is misused it can be cancelled without closing the account.
Agent Pay applies the same idea to AI assistants. The shopper's card stays with the bank. The assistant gets its own stand-in card number that works only for that assistant and only within the rules the shopper agreed to. Mastercard checks that the assistant is a known, registered one before it can pay, and the shop and the bank both see a flag saying the purchase was made by an agent. If something looks unfamiliar, there is a route for the shopper to query it.
History
Mastercard launched the program on 29 April 2025 and said it would work with Microsoft, integrating Azure OpenAI Service and Copilot Studio with its payment services, with other AI platforms to follow. It named IBM's watsonx Orchestrate for business uses, and the checkout and acquiring firms Braintree and Checkout.com as partners for extending tokenisation to agent purchases.
On 10 September 2025 Mastercard said all US Mastercard cardholders would be enabled for Agent Pay by the holiday season, with a global rollout to follow, and that Citi and U.S. Bank cardholders would be the first able to try it. It named Stripe, Google and Ant International's Antom among the companies it was working with and launched an Agent Toolkit that exposes its API documentation to AI coding tools through a Model Context Protocol server. In March 2026 it announced Verifiable Intent, an open specification for proving what a user authorised, and said it would be built into Agent Pay.
How it works
Mastercard has described the program in terms of four commitments:
- Registered agents. An AI agent must be registered and verified before it can pay. In September 2025 Mastercard added an Agent Sign-Up process for developers to identify their agents.
- Agentic Tokens. Payments use tokens that build on Mastercard's existing network tokenization, the same technology behind mobile contactless payments and saved cards. The agent never holds the real primary account number (PAN).
- Consumer control. The cardholder decides what the agent is allowed to buy, a set of limits that the industry calls an agentic mandate. Strong authentication can use on-device biometrics.
- Visibility and disputes. Agent-initiated transactions are marked so that the card issuer and the merchant can recognise them, and Mastercard has described a process for clarifying agent purchases a cardholder does not recognise.
From the merchant's side, an Agent Pay purchase arrives as a tokenised card-not-present transaction and is routed through the merchant's acquirer as usual. Because the token is scoped to one agent, it can be suspended without reissuing the cardholder's physical card.
Standards work
Mastercard has tied the program to industry standards rather than a closed system. With the payments working group of the FIDO Alliance, it announced in September 2025 that it was helping develop a verifiable credential for payments that confirms details such as amount, merchant and product, so that all parties can see the shopper approved the transaction. Verifiable Intent, co-developed with Google and published as a draft in March 2026, builds on work from FIDO, EMVCo, the IETF and the W3C. Cloudflare has also said it is working with Mastercard on Web Bot Auth, a method for agents to prove their identity to websites with cryptographic signatures.
Limitations and criticism
As with other network agent programs, important questions were still open as of November 2026:
- Liability. It is not settled who bears the loss when an agent stays within its limits but buys something the user did not want. Card chargeback reason codes were not designed with agents in mind.
- Fragmentation. Merchants face parallel schemes from Mastercard, Visa and others, plus several competing checkout protocols, which raises integration costs.
- Thin evidence of demand. Mastercard's announcements describe enablement and pilots; it has published little data on how many consumers actually use agents to pay.
- Network power. The programs also place the card networks inside AI-driven checkout, a role that account-to-account and stablecoin payments are competing for as well.
Supporters reply that tokens and registered agents are a clear improvement on early agent tools that simply stored a user's card number and typed it into checkout forms.