Mastercard Backs Agent Pay Tokens Over Virtual Card Numbers for AI Purchases
Oct. 29, 2026 • Article • AI in Fintech
Mastercard is seeking to make network tokens the payment standard for purchases initiated by AI agents. On its October 29, 2026, earnings call, Chief Executive Michael Miebach described processor-issued one-time virtual card numbers as a temporary bridge rather than a lasting approach. He said Mastercard would support end-to-end tokenization through Agent Pay to preserve cardholder choice, rewards and spending controls.
The company also announced that Shopify is integrating Agent Pay and network tokens into Shop Pay, alongside a strategic partnership with OpenAI covering AI payments and services. Mastercard has been building merchant-facing tools for agentic commerce throughout 2026, but Miebach acknowledged that merchants’ technical readiness remains uneven. Other payments companies are developing their own approaches: Stripe supports agentic network tokens from Mastercard and Visa, while Visa has introduced tools for AI-driven shopping. Consumer concerns about fraud and liability remain a potential barrier to adoption.
Mastercard is pushing for its network-token standards to underpin purchases made by AI agents, rejecting processor-issued one-time virtual card numbers as a lasting payment method for such transactions. On the company’s October 29, 2026, earnings call, Chief Executive Michael Miebach said virtual card numbers could serve as a temporary bridge while processors adapt, but argued that agent payments should use end-to-end tokenization through Mastercard Agent Pay.
The distinction matters because an AI agent making a purchase must be able to use a consumer’s payment credentials without weakening the protections attached to the underlying card account. Mastercard says its approach is intended to preserve cardholder choice, rewards and spending controls. Its position also puts the network’s payment standards at the center of a developing debate over how AI-initiated transactions should be authorized.
Mastercard announced on the call that Shopify is integrating Agent Pay and network tokens into Shop Pay for AI-driven purchases. It also unveiled a strategic partnership with OpenAI covering AI payments and services. Miebach told analysts that AI is changing how commerce happens and said Mastercard expects adoption to build as the holiday shopping season approaches.
Why Mastercard Is Drawing a Line on Payment Credentials
A one-time virtual card number is a payment credential created for an individual transaction. Mastercard’s concern, as presented in the research on its earnings call, is that using processor-issued numbers as the permanent front end for agent purchases can obscure the underlying consumer account from the network and issuer. That could make it harder to carry existing cardholder controls and benefits through an AI-driven transaction.
Network tokens offer the alternative Mastercard is advocating. Rather than giving an AI agent raw card credentials, a tokenized payment uses a substitute credential associated with the card network’s payment framework. Miebach said Mastercard would support end-to-end tokenization through Agent Pay, rather than treating one-time virtual card numbers as the permanent architecture for agentic commerce.
The stance does not mean Mastercard has established a universal standard. Stripe said in March that it had begun supporting agentic network tokens from both Mastercard and Visa. Under Stripe’s approach, tokens can be provisioned to AI agents according to a buyer’s intent, allowing them to transact with participating merchants without exposing raw card credentials. The development shows that payment providers are already working with network tokens, even as the wider market determines how agent transactions will operate.
Merchant Tools and an Uneven Rollout
Mastercard’s current payments push follows a broader buildout of services for AI-driven commerce. In January 2026, it launched Mastercard Agent Suite as an advisory service to help enterprise clients deploy customizable AI agents. In September, it expanded the suite for merchants and introduced Mastercard Agent Connect, together with an integration blueprint using Anthropic’s Claude models. Those offerings are designed to help merchants make product catalogs and inventory available to third-party commercial AI agents.
These tools address a different part of the transaction from Agent Pay. An agent must be able to find products and interact with a merchant before a payment can take place. Miebach acknowledged that merchant technical integration remains a “patchwork” and that “not all merchants are ready” to be indexed and shopped by autonomous bots. That limits how quickly payment capability alone can translate into widespread AI-driven buying.
Visa is also developing infrastructure for agentic commerce. It has launched Visa Intelligent Commerce and a Trusted Agent Protocol, alongside an Agent Score metric designed to assess whether AI agents can access product information on merchant websites without being stopped by anti-bot protections. The initiatives illustrate that both card networks are addressing more than payment credentials: agents also need a way to reach merchants and complete purchases.
Adoption Depends on Trust as Well as Technology
Consumer safeguards remain another unresolved issue. A PYMNTS Intelligence and Worldpay study found that 45% of consumers expressed willingness to let AI agents make purchases for them, while 95% reported concerns. Half said they would need clearly defined fraud and chargeback liability protections before adopting agent purchases. Those findings point to a gap between interest in the technology and confidence in how problems would be handled.
Mastercard reported third-quarter 2026 net revenue of $9.8 billion, up 14% from a year earlier, and net income growth of 18%. Its Value-Added Services and Solutions business, which includes agentic commerce and trust software, grew 19%. Those results provide context for the company’s investment in the area, but do not establish how much revenue AI-agent transactions will generate.
For now, Mastercard has set out a clear preference: AI purchases should retain the protections and controls associated with network-tokenized card payments, rather than rely permanently on one-time virtual card numbers. Whether that approach becomes broadly used will also depend on merchant readiness and consumers’ confidence in the rules governing agent-made purchases.
Mastercard is seeking to make network tokens the payment standard for purchases initiated by AI agents. On its October 29, 2026, earnings call, Chief Executive Michael Miebach described processor-issued one-time virtual card numbers as a temporary bridge rather than a lasting approach. He said Mastercard would support end-to-end tokenization through Agent Pay to preserve cardholder choice, rewards and spending controls. The company also announced that Shopify is integrating Agent Pay and network tokens into Shop Pay, alongside a strategic partnership with OpenAI covering AI payments and services. Mastercard has been building merchant-facing tools for agentic commerce throughout 2026, but Miebach acknowledged that merchants’ technical readiness remains uneven. Other payments companies are developing their own approaches: Stripe supports agentic network tokens from Mastercard and Visa, while Visa has introduced tools for AI-driven shopping. Consumer concerns about fraud and liability remain a potential barrier to adoption.
The Linux Foundation appointed payments veteran Michael Hursta executive director of the x402 Foundation on October 1, 2026, as payment systems designed for autonomous AI agents gained attention. Foundation members reported more than 75 million agentic payment transactions in a 30-day period in September, and Coinbase and Amazon Web Services showcased production payment rails at Sibos 2026. Reported transaction counts, however, do not establish the value or commercial character of that activity. The emerging protocols address different obstacles. Coinbase’s x402 enables per-request USDC payments through HTTP, while Google’s Agent Payments Protocol uses signed mandates to connect an agent’s purchases to a user’s authorization. Stripe and Tempo have also proposed session-based billing through the Machine Payments Protocol. These approaches respond to card fees and interactive checkout checks that can impede small, automated transactions. Card networks are developing delegated-identity tools, leaving multiple potential paths for agent payments rather than a single replacement for existing rails.
Mastercard opened developer early access for Agent Pay for Machines (AP4M) on October 20, 2026, releasing buyer- and seller-side APIs, a sandbox and developer toolkits. In a Cloudflare Connect demonstration, marketing agency Hype tested an autonomous agent making nine payments to two merchants within a single budget, without manual billing or account setup. AP4M uses HTTP 402 payment challenges, but differs from crypto-native implementations of the x402 protocol. Its agents issue digitally signed vouchers off-chain; merchants can batch and redeem them later instead of settling every request on-chain. The pilot combined agent wallet infrastructure from Coinbase Developer Platform and BVNK, settlement on Base, and Mastercard’s multi-currency fiat and stablecoin settlement platform. Circle separately expanded its managed payments service to target AI-agent traffic using USDC. Together, the developments show competing approaches to machine-to-machine payments, with different choices about settlement, funding and who manages digital assets.
Visa launched a live pilot with BILL and Billtrust at Money20/20 USA in late October 2026 to test end-to-end B2B invoice payments executed by software agents. The agents act on invoices enterprise buyers have already approved; they do not decide which supplier payments to authorize. Visa’s Trusted Agent Protocol and Agentic Directory are designed to authenticate those agents when they access supplier and merchant portals without shared credentials or manual human login. Separately, Visa has put Commercial Payment Controls into production for eligible issuers in supported regions, allowing businesses to set limits and restrictions on corporate spending. The company plans general availability of Commercial Virtual Authentication and Commercial Supplier Validation in 2027 after pilot completion. Its SESA 2.0 analytics platform has identified more than $600 billion in potentially cardable supplier spend. The pilot tests whether approved invoice payments can be executed through automated workflows while preserving buyer-defined controls.
Mastercard and Visa are advancing different approaches to AI-initiated business payments. At Cloudflare Connect, Mastercard demonstrated an agent making nine payments across multiple service providers under one authorized budget. It also opened early developer access to Agent Pay APIs, a sandbox and toolkits. Visa expanded its commercial agentic suite around a BILL and Billtrust pilot, alongside spend analytics and fraud tools. The distinction is how each approach constrains the agent. Visa’s pilot lets an agent pay invoices that buyers have already approved, using its Trusted Agent Protocol to navigate supplier-portal security without sharing underlying login credentials. Mastercard is testing controls for machine-to-machine transactions, including signed vouchers, agent verification and a score intended to estimate whether an incoming transaction was AI-initiated. Both efforts leave a consequential question for business payments: how responsibility should be assigned when an authorized agent follows its technical instructions but breaches a procurement condition.
Mastercard opened developer APIs, SDKs and a sandbox for Agent Pay for Machines (AP4M) on October 21, 2026. The tools enable autonomous AI agents on Amazon Bedrock to make multi-merchant micropayments over x402 using off-chain signed vouchers. The launch follows Coinbase Developer Platform’s report that cumulative x402 payments across Base and Solana had exceeded 100 million by October. The x402 protocol uses an HTTP 402 response to tell an agent what a service costs and how to pay. Its growing infrastructure includes a Linux Foundation-governed foundation, while alternative approaches use Lightning payments or existing processor rails. Transaction counts, however, do not establish how much genuine agent-led commerce is taking place. TRM Labs found a much smaller pool of plausible commercial trade after screening out other activity. Security questions also remain, including whether a service can receive payment without delivering its output. Developers therefore face choices about settlement, spending controls and proof of service.