Crossmint has rolled out a new API that lets artificial intelligence agents tap into Visa’s payment network to make purchases. The tool, built on tokenized credentials and spending controls, opens the door for autonomous software to handle transactions without a human swiping a card.
How the API works
The API essentially gives an AI agent its own payment credentials. When the agent needs to buy something — say, cloud computing time or a subscription service — it can present a token tied to an eligible Visa card. The system verifies the agent’s identity and spending limits before authorizing the charge.
Crossmint says the design keeps the actual card number hidden. Instead, a one-time token stands in for the real credentials, limiting exposure in case of a breach. Spending controls let companies cap how much an agent can spend per transaction, per day, or per month.
Tokenized credentials and spending controls
The tokenization piece isn’t new in payments, but applying it to machine-to-machine commerce is a twist. Instead of a wallet or a physical card, the AI agent gets a digital token that behaves like a card but can be revoked or adjusted instantly.
Those spending controls matter. A rogue agent with an open checkbook could rack up charges fast. Crossmint’s API lets administrators set rules upfront — for example, “this agent can only spend $50 per day on API calls from provider X.” If the agent tries to exceed the limit, the transaction fails.
What this means for AI commerce
Until now, most AI agents operated in sandboxed environments or relied on human approval for every expense. That slows things down. Crossmint’s approach allows agents to act autonomously within predefined boundaries, buying what they need when they need it.
The immediate use cases are in developer tools, cloud services, and SaaS subscriptions — places where a bot might provision resources or renew licenses. E-commerce isn’t the target yet, but the same mechanics could work for digital goods or even physical purchases if retailers accept Visa.
Visa’s involvement isn’t an endorsement of every AI spending spree. The card network processes the transaction as it would any other, with the token standing in for the card number. The fraud and dispute rules still apply, though who’s liable when an AI buys something it shouldn’t remains a question the industry hasn’t fully answered.
Crossmint didn’t name any customers already using the API in production. The company said it’s in early testing with a handful of developers. Broader availability is expected later this year.