Private preview
Pay with Issuing in agentic payment flows Private preview
Let agents pay sellers through Stripe-backed programmatic protocols without sharing card credentials.
When your agent tries to complete a purchase, the seller might offer a programmatic payment flow. It’s a deterministic, machine-readable way to pay (often an HTTP challenge, a structured API, or a protocol handler) without parsing checkout-page HTML.
Stripe-backed examples include the Machine Payments Protocol (MPP) and, where supported, UCP. This guide explains how to fund those flows with an Issuing card in your Stripe account.
When this applies
Use this guide when all of the following are true:
- Your agent pays on behalf of your business using Issuing (an ic _ * virtual card you issue and control).
- The seller supports a Stripe-backed programmatic payment flow. For MPP, its endpoint returns an HTTP 402 with payment requirements. For UCP, its profile advertises the com. stripe. payments handler.
- You want a structured integration path—the agent follows a defined protocol instead of parsing checkout pages.
If the seller only supports browser checkout, retrieve the virtual card credentials and use the card directly. The SPT flow below applies only when the seller identifies support for a Stripe-backed protocol.
Convert the card to a Shared Payment Token (SPT)
Don’t hand your agent the card number or a long-lived payment method. Programmatic flows use a “seller-scoped, amount-limited, time-limited” credential without exposing the underlying card.
A Shared Payment Token (SPT) is this credential. You still fund the purchase from your Issuing card, but the seller redeems an spt_* scoped to their Stripe profile. When the seller attempts payment, the charge runs through your existing Issuing real-time authorization path—before capture and settlement.
An SPT remains usable until it expires, you revoke it, or cumulative captured payments reach usage_limits[max_amount].
How Issuing controls and SPT limits work together
Issuing card controls and SPT limits solve different problems, and both apply:
| Layer | What it controls |
|---|---|
| Issuing card | Baseline spend policy—limits, allowed categories, lifecycle—and whether you approve each authorization in issuing_authorization.request webhooks |
| SPT | What a specific seller can charge for this programmatic purchase—amount, currency, and expiration |
Set card-level controls as your ongoing fraud and spend policy. Set SPT usage_limits to match the purchase your agent is completing for that seller. An authorization must satisfy both your card controls and the SPT grant.
Verify webhook signatures and allowlist Stripe IP addresses on your webhook endpoint so you only approve authorizations from genuine Stripe events.
What you’ll build
Programmatic payment with Issuing chains three Stripe objects before the agent pays through the protocol (MPP, UCP, or similar):
- Issuing card ( ic _ * ): The funding source in your account.
- PaymentMethod ( pm _ * ): A buyer-owned clone of the Issuing card in your account, created without exposing the PAN or CVC. The seller never receives this object.
- Shared Payment Token ( spt _ * ): A scoped grant derived from the PaymentMethod that the agent presents to the seller’s programmatic endpoint.
Before you begin
- Issuing enabled on your Stripe account
- A Stripe profile ( profile _ * ) for your business and for the seller
- A seller that identifies support for a Stripe-backed programmatic flow, such as MPP or UCP
- Preview API version 2026-04-22. preview for PaymentMethod-from-Issuing-card and SPT requests. See the private preview release channel .
- Private preview access to create PaymentMethods from Issuing cards. Contact us to request access.
Issue an Issuing card
Issue a virtual card in your account with spend controls that match how your agent spends. These controls remain in effect for every authorization on the card, including payments funded through an SPT.
Command Line
Select a language
cURL
Stripe CLI
Ruby
Python
PHP
Java
Node.js
Go
.NET
No results
Create a PaymentMethod from the Issuing card
Private preview
This API is in private preview. Without access, we reject card[issuing_card] as an unknown parameter.
Use a restricted API key with PaymentMethod write ( payment_method_write) permission or your account secret key only during development. Clone the Issuing card into a buyer-owned PaymentMethod—still in your account, and not the seller’s:
Command Line
Select a language
cURL
Stripe CLI
No results
Returns a pm_* object in your account.
Issue an SPT from the PaymentMethod
Use a restricted API key with Shared payment token write ( shared_payment_token_write) permission or your account secret key only during development. Create an SPT scoped to the seller’s profile and the purchase amount:
Command Line
Select a language
cURL
Stripe CLI
Ruby
Python
PHP
Java
Node.js
Go
.NET
No results
- payment _ method : The pm _ * from the previous step.
- usage _ limits[max _ amount] : Maximum spendable amount, in the smallest currency unit (for example, 1000 = 10.00 USD).
- usage _ limits[currency] : ISO currency code for the limit.
- usage _ limits[expires _ at] : Unix timestamp after which the token can no longer be used.
- seller _ details[network _ business _ profile] : The seller’s Stripe business network profile ID ( profile _ * ). In test mode, you can use the test profile ID shown above.
Returns an spt_* object.
Present the SPT to the seller
Give the spt_* to your agent to present at the seller’s programmatic endpoint. For MPP, the seller responds with an HTTP 402 challenge that includes payment requirements. Your agent retries with the SPT credential to complete payment.
Other Stripe-backed protocols follow their own discovery and credential exchange steps. See the seller’s protocol documentation—for example, the MPP quickstart or UCP Stripe Payments handler.