By MastercardLearning Objectives
- Understand how a payment network can let an AI agent transact without holding the raw card number
- Learn what Verifiable Intent is and why a provable record of authorization matters for agent payments
- Assess the accountability gaps that remain as agentic payments move into live use
What Is Mastercard Agent Pay?
Mastercard Agent Pay is a framework that lets verified AI agents complete purchases on a consumer's behalf. It rests on three pieces: Agentic Tokens that bind a card credential to a specific agent and scope, biometric passkeys that let a consumer confirm higher-value transactions, and a tamper-proof "Verifiable Intent" record that captures exactly what the user authorized. Together they solve the trust problem at the heart of agent shopping — a merchant and issuer need confidence that a legitimate agent is acting, within limits the consumer actually set, before money moves.
Mastercard is one of the world's largest payment networks, founded in 1966 and headquartered in Purchase, New York, trading publicly as Mastercard Incorporated (NYSE: MA) since its 2006 listing. It announced Agent Pay on April 29, 2025 as part of its broader Mastercard Agent Suite, extending its existing tokenization service to the agent era. The first live agentic payments were executed in 2026, with early authenticated deployments rolling out in Southeast Asian markets.
💡Key Concept
Verifiable Intent: When an AI agent buys something, the hard question is proving the human really approved that action. Verifiable Intent creates a tamper-resistant record of what the user authorized — the item, the limit, the conditions — so every party can later confirm the agent stayed inside its mandate. It is designed to be protocol-agnostic rather than tied to one assistant.
✅Tip
Visit Mastercard Agent Pay: mastercard.com — for AI platforms, banks, and merchants enabling agent payments; enterprise partnership, delivered through Mastercard-certified processors.
Core Capabilities
Agentic Tokens
Agentic Tokens extend Mastercard's Digital Enablement Service by binding a tokenized credential to a specific agent, a merchant scope, and a consent policy. A model such as a shopping assistant can therefore complete checkout without ever holding the raw card number.
Verifiable Intent record
The framework generates a tamper-resistant, standards-based record of what the consumer authorized when the agent acted. This trust layer is being aligned with open agent-payment protocols so it works across different assistant ecosystems rather than a single vendor's stack.
Payment passkeys and step-up
Biometric passkeys let a consumer set step-up rules — for example, requiring a fingerprint or a push confirmation before an agent completes a higher-value purchase — adding a human checkpoint where risk is greatest.
Delivery through certified processors
Rather than a standalone product, Agent Pay is delivered through Mastercard-certified processors, letting banks and merchants reach agent commerce through infrastructure they already use.
Strengths
- Provable authorization: The Verifiable Intent record gives every party evidence of what the consumer actually approved, not just an assertion.
- Card number stays hidden: Agentic Tokens keep the raw credential out of the agent's and merchant's hands entirely.
- Human checkpoints where they matter: Passkey step-up rules add friction only for higher-risk purchases.
- Standards-aligned: Designing the trust layer to be protocol-agnostic lowers the risk of merchants betting on an incompatible standard.
Limitations & Considerations
- Early live rollout. Agentic payments only began executing in production in 2026; real-world scale, edge cases, and dispute patterns are still being learned.
- Accountability is unsettled. When an agent is manipulated or errs, who is liable — consumer, merchant, processor, or network — has not been firmly resolved even with an intent record in hand.
- Depends on ecosystem adoption. The framework only delivers value where issuers, processors, and AI platforms all support compatible tokens and protocols.
- Consent complexity. Capturing genuine, informed intent for a standing agent that makes many future purchases is harder than confirming a single checkout.
Best Use Cases
| Task | Why Mastercard Agent Pay |
|---|---|
| Proving an agent had permission to buy | Generates a tamper-proof Verifiable Intent record |
| Letting an assistant check out securely | Agentic Tokens replace the raw card number |
| Requiring approval on large purchases | Passkey step-up rules add a human confirmation |
| Reaching agent commerce through a bank | Delivered via Mastercard-certified processors |
Getting Started
- Identify your role — AI platform, issuing bank, or merchant — since each consumes a different part of Agent Suite.
- Review Mastercard's Agent Pay and Agentic Token documentation to understand token scoping and the intent record.
- Work through a Mastercard-certified processor to provision access and define step-up rules.
- Start with tightly scoped tokens and passkey confirmations before widening the range of agent-initiated purchases.
Key Takeaways
- Mastercard Agent Pay lets verified AI agents pay for consumers using Agentic Tokens, biometric passkeys, and a Verifiable Intent record.
- Verifiable Intent is the standout idea: a tamper-proof, protocol-agnostic record of exactly what the user authorized.
- Announced in April 2025, it executed its first live agentic payments in 2026 through certified processors.
- The honest caveats are an early rollout and unresolved accountability when an autonomous agent is manipulated or makes a mistake.
