Built to work everywhere

Our users’ agents have successfully logged in and checked out on the following sites and apps.

Give your agent a
card or login that can’t leak

Agent Vault protects your credit cards and login details so your agents can get work done wherever you are.

Cards

Per-card caps, merchant allowlists and a kill switch.

Agent VaultVAULTED

@5N% W6G2 @@*D R&EB

HOLDERQ%$GR* JN47

EXPKC/JQ

VISA

PCI-DSS Level 1 vault

Logins

One credential set per site, safely swapped at the moment of submit, without the agent ever seeing it.

USERNAME

Mq$r2Wbc3wXzyg6*qnggdf%bR&z5V

PASSWORD

A8Kxc7RGru3Cuev*EgmeKkBd%46Bc

Film in production

Your agent does the work
while you stay in control

One vault to rule them all. Enter your credentials once, and every agent you use can work with them.

session_a

session_b

session_c

session_d

session_e

session_f

Isolation

Each session runs in its own browser context. Cookies, storage and cache never cross between them.

Limits

Daily, weekly, monthly and per-transaction caps. Optional merchant allowlists. Auto-pause on any limit exceeded.

Kill switch

Revoke a card or a login at any time, effective immediately. Proxy sessions end after 15 minutes idle.

How it works

You store your secrets once and scope each agent in the dashboard.

01Untrusted
agent
visible

The agent only holds mock tokens

A compromised agent can leak them without any harm to the user. Real credentials are protected.

02The
trust
boundary

It crosses the boundary

The token is the only thing that ever moves from the untrusted side to the trusted one. Nothing real crosses this line.

03Trusted
isolated
enclave

The card is revealed in the enclave

The proxy only ever holds an opaque token. The enclave looks the card up and types it into the checkout. It is the one place the card exists in the clear.

04The
open
world

The merchant sees an ordinary payment

The enclave’s traffic is tunnelled back out through your own machine, so the transaction usually arrives from your IP.

05How
this is
different

The problem with single-use agent cards

Single-use cards still put a real card number in the agent’s hands, and a prompt injection can steal it. Agent Vault never hands one over. Never worry about prompt injections again.

Your agent Playwright · LLM may be prompt-injected

Mock tokens av_card_1_number_u7x2k hollow, no value inside

                                                      
                                                      
                                                      
                               ········                       
                         .··:·:········:·:··.                 
                      ···:··················:···              
                    ·:··.·.·.·.········.·.·.·.··:·            
                  .:··.·.·.·.············.·.·.·.··:.          
                 .:··.·.·.··.·:::++++:::·.··.·.·.··:.         
                ······.····:++::::::::::++:····.······        
                ::.·······++:::++++++++:::++·······.::        
               ·:···.····++:+++***++***+++:++····.···:·       
               :········++::++#+      +#++::++········:       
               :········++::++#        #++::++········:       
               :········++::++#+      +#++::++········:       
               ·:···.····++:+++***++***+++:++····.···:·       
                ::.·······++:::++++++++:::++·······.::        
                ······.····:++::::::::::++:····.······        
                 .:··.·.·.··.·:::++++:::·.··.·.·.··:.         
                  .:··.·.·.·.············.·.·.·.··:.          
                    ·:··.·.·.·.········.·.·.·.··:·            
                      ···:··················:···              
                         .··:·:········:·:··.                 
                               ········

                                                      
                                   .                          
                                   .                          
                                   .                          
                                   .                          
                  .              ..·.              .          
                  .·            .·.··.            ·.          
                  ···          .··.···.          ···          
                  .···        .···.····.        ···.          
                  ·····      .····.·····.      ·····          
                  .·····    .·····.······.    ·····.          
                  ·····:·   ::····.·····::   ·:·····          
                  ·····:::.:::····.·····:::.:::·····          
                  ..···::*#+::···..·.···::+#*::···..          
                  ·····:::.:::····.·····:::.:::·····          
                  ·····:·   ::····.·····::   ·:·····          
                  .·····    .·····.······.    ·····.          
                  ·····      .····.·····.      ·····          
                  .···        .···.····.        ···.          
                  ···          .··.···.          ···          
                  .·            .·.··.            ·.          
                  .              ..·.              .          
                                   .                          
                                   .                          
                                   .                          
                                   .

Untrusted side your agent · the browser · the open web holds tokens only

Trusted side proxy · vault · enclave no path inward

Agent Vault proxysession · policynever holds the card

PCI vaultBasis Theory · DSS Level 1encrypted at rest, keyed per tenant

                                                      
                                                      
                                                      
                            :++++*##*++++:                    
                       ··:::*++: +  + :++*:::··               
                     .+:··· ··.·+:··:+·.·· ···:+.             
                   .·:+::·.:··. :    : .··:.·::+:·.           
                  ::: ··.·::····:·.··:····::·.·· :::          
                 +:. ·.   : ...:......:... :   .· .:+         
                ··:·:·...:..   ·      ·   ..:...·:·:··        
               ·::·.:····:····.:......:.····:····:.·::·       
               +·.·:·.·. ·    .:......:.    · .·.·:·.·+       
              .:+· ·  ..:......:......:......:..  · ·+:.      
              ·:···:··  ·      ·      :      :  ··:··::·      
              .:+· ·  ..:......:......:......:..  · ·+:.      
               +·.·:·.·. ·    .:......:.    · .·.·:·.·+       
               ·::·.:····:····.:......:.····:····:.·::·       
                ··:·:·...:..   ·      ·   ..:...·:·:··        
                 +:. ·.   : ...:......:... :   .· .:+         
                  ::: ··.·::····:··.·:····::·.·· :::          
                   .·:+::·.:··. :    : .··:.·::+:·.           
                     .+:··· ··.·+:·::+·.·· ···:+.             
                       ··:::*++: +  + :++*:::··               
                            :++++*##*++++:

Confidential Compute enclave

attested hardware · no operator access

av_card_1_number_u7x2k 4242 4242 4242 4242

Your machinetunnel exit · your IPon by default

Merchant checkoutan ordinary card transaction, arriving from your IP

                                                      
                                                      
                                 :  .                         
                               · +: + :                       
                    · :.  :.   + ++ + +   .:·:   .            
                    ·:·:·:·+ :  +++ ++ ·  +·:::·:·            
                     ··:::::++::+++ +++:·+:::::::·            
                      :::::::++*++·++++*+::+::::              
                   · ::+++:+++++*++*++*++++::+:.  ·:          
             ·:·  :+::+:++*++++*#*+*+**++++++*++::+:· ·.      
             ·::::::+::++*+***+**#+*#**+***+*++::+:::::::.    
                ·+::::+++++***#+:    :+##**+++++::::+:·       
                 :+++++++++***:        :***++++++++:          
                  .::::+******          ******+::::.          
                  :++++++++***:        :***+++++++++:         
               ·:+::::+++++**##+:    :+#***+++++::::+·        
            .:::::::+::++*+***+**#+*#**+***+*++::+::::::·     
              .· ·:+::++*++++++**++**#*++++*++:+::+:  ·:·     
                  :·  .:+::++++*+++*+*+++++:+++:: ·           
                      ::::+::+*+++·+++*++:::::::              
                    ·:::::::+·:+++ +++::++:::::··             
                    ·:·:::·+  · ++ +++  : +·:·:·:·            
                    .   :·:.   + + ++ +   .:  .: ·            
                               : + :+ ·                       
                                 .  :

                                                      
                                                      
                                                      
                                                      
                                                      
  ..·.·.·....                           ...........   
   .........·.                        .··.........    
    .....·······                    .·······.....     
     ......····::·.                ·······......      
      .........···:·             ·::··........        
        .........··::·         ·:::··........         
         .........···::·     .:::·..........          
          ..........·····   .:::·..........           
           ..........::+++  *+:·..........            
            .........:+**:··+#+:.........             
              ......·:+:··::·:*+........              
               ....·::···::::··::.....                
                ..···············:...                 
                 ......·······......                  
                   .....······.....                   
                    ..............                    
                     ............

Every other approach Agent Vault

Card safe from prompt injection

No Yes

You’re protected

A page contains injected instructions. The agent dumps its context to an attacker-controlled endpoint. Here is the entire difference that makes.

Agent VaultVAULTED

4242 4242 4242 4242

HOLDERTAYLOR CHEN

EXP09/28

VISA

BILLING ZIP 94105

Agent context

The card number

Sixteen digits, and whoever holds them can charge them. The agent is handed a token of the same shape that charges nothing, anywhere.

The name on the card

Your legal name is an identity claim, not a string the agent needs. It is vaulted with everything else and swapped the same way.

The billing ZIP

Enough on its own to pass address verification. Treated as a secret, because to a fraud check that is exactly what it is.

{ "card_number": "av_card_1_number_u7x2k""4242 4242 4242 4242", "cardholder": "av_id_first_name_u7x2k""Taylor Chen", "billing_zip": "av_addr_bill_zip_u7x2k""94105" }

If it uses Playwright, it works.

One drop-in import covers the whole vault: the same swap fills card fields at checkout and credential fields at sign-in. Keep the rest of your agent code.

shopping-agent.ts

import { chromium } from 'playwright@agentvault/playwright'; await page.goto(url); await page.fill('#card', CARD_NUMBER'av_card_1_number_u7x2k'); await page.fill('#name', CARDHOLDER'av_id_first_name_u7x2k'); await page.click('#pay');

Claude Code

Anthropic’s CLI agent

OpenClaw

Open-source runtime

Playwright scripts

Plain Node + browser

Computer Use

Anthropic’s browser tool

Built for agents that transact
and sign in.

DRAG A CARD

Agent VaultPROCUREMENT

av_card_3_number_p5r1m

HOLDERav_id_first_name_p5r1m

EXPav_exp_p5r1m

VISA

Agent VaultRESEARCH

av_card_2_number_k9d4v

HOLDERav_id_first_name_k9d4v

EXPav_exp_k9d4v

VISA

Agent VaultSHOPPING

av_card_1_number_u7x2k

HOLDERav_id_first_name_u7x2k

EXPav_exp_u7x2k

VISA

Active agent Shopping $142 of $200 this week

Weekly ceiling. $58 left.

Personal shopping

“Book me a flight under $400.” Keep the agent to a weekly cap.

Research agents

Buy reports, data access or paywalled papers on demand.

Dev tools

Purchase API credits when a rate limit is hit mid-pipeline.

Procurement

Small teams that let an assistant handle recurring orders.

Open source

Most of the web speaks no agent protocol.

The Checkout Recipe Registry is a community catalogue of per-merchant checkout recipes — machine-readable JSON with a schema, a validator and an autonomy benchmark. Any Playwright agent can read it, with or without Agent Vault.

Browse the registry → Read the schema →

Start free,
scale when you’re ready.

Free

$0/month

Everything you need to give one agent a card with sensible defaults.

1 agent card
5 payments per month
Unlimited credentials

Every plan includes:

Kill switch on every card and login

Get started

No card required.

PlusFREE FOR 3 MONTHS

~~Was $49~~, now $19/monthLock in lifetime pricing

More volume, daily spend limits and webhook notifications.

5 agent cards
100 payments per month
Unlimited credentials

Everything in Free, plus:

Daily spend limits
Webhook notifications

Choose Plus

First 1,000 sign-ups only. Change or cancel any time.

Enterprise

Contact us for pricing

The highest volume, unlimited agent cards and merchant allowlists.

Unlimited agent cards
Unlimited payments
Unlimited credentials

Everything in Plus, plus:

Merchant allowlists
Priority support

Contact us

team@self.xyz

Compare all features

Feature

Free

Plus

Enterprise

Agent cards

1

5

Unlimited

Payments per month

5

100

Unlimited

Credentials

Unlimited

Daily spend limits

—

Yes

Webhook notifications

—

Yes

Merchant allowlists

—

Yes

Priority support

—

Yes

Kill switch on every card and login

Yes

Things people ask.

If something is missing, write to us. We answer honestly, including about what we don’t have yet.

It gets a mock token it can leak all day. The real card number was never in the room. Mock tokens expire in 15 minutes and only work through our proxy, so they have no value outside a short window and a specific session.

Card numbers are tokenized to Basis Theory, a PCI-DSS Level 1 vault. We hold a token, never the number.

An ordinary card transaction. Traffic is tunnelled back out through your own machine, so it usually arrives from your IP.

Yes. Revoke a card or a login at any time from the dashboard; sessions using it stop working at once.

A bank’s virtual card rotates the number; it does not remove it. The agent still ends up holding something chargeable — equally true of the single-use cards Stripe Link and AgentCard issue. Agent Vault never puts a real number in front of the agent.

What we hold, and what we never touch.

Who holds what, in one place, for the moment you are deciding whether to hand over a card.

Custody What that means for you

The card number

Basis Theory is the custodianPCI-DSS Level 1 Agent Vault holds a reference to it

Your agent’s context

We never read it Only the policy you set reaches us

When you revoke

No grace window Enforced at the vault, not in the agent

Agent Vault is operated by Self

Two lines, then your agent pays.

01

Install

npm i https://app.agentvault.io/sdk/agentvault-playwright.tgz

02

Swap the import

import { chromium } from '@agentvault/playwright'

03

Scope the agent

Issue a card in the dashboard, set its ceiling, and paste the key. Your existing selectors keep working.

Read the docs →

Give agents authority,
not access to real credentials.

Get started free Try the live demo →

No card required · 5 payments a month on the free plan

Superpowers for your agents

Built to work everywhere

Give your agent a cardcard or login that can’t leak

Cards

Logins

Your agent does the work while you stay in control

Isolation

Limits

Kill switch

How it works

The agent only holds mock tokens

It crosses the boundary

The card is revealed in the enclave

The merchant sees an ordinary payment

The problem with single-use agent cards

You’re protected

The card number

The name on the card

The billing ZIP

If it uses Playwright, it works.

Claude Code

OpenClaw

Playwright scripts

Computer Use

Built for agents that transact and sign in.

Personal shopping

Research agents

Dev tools

Procurement

Most of the web speaks no agent protocol.

Start free, scale when you’re ready.

Things people ask.

What happens if the agent gets prompt injected?−

Is this PCI compliant?+

What does the merchant see?+

Can I revoke an agent’s access immediately?+

How is this different from a virtual card from my bank?+

What we hold, and what we never touch.

Two lines, then your agent pays.

Install

Swap the import

Scope the agent

Give agents authority, not access to real credentials.

Give your agent a
card or login that can’t leak

Your agent does the work
while you stay in control

Built for agents that transact
and sign in.

Start free,
scale when you’re ready.

Give agents authority,
not access to real credentials.