# Pay with Issuing in agentic payment flows

Let agents pay sellers through Stripe-backed programmatic protocols without sharing card credentials.

When your agent tries to complete a purchase, the seller might offer a programmatic payment flow. It’s a deterministic, machine-readable way to pay (often an HTTP challenge, a structured API, or a protocol handler) without parsing checkout-page HTML.

Stripe-backed examples include the [Machine Payments Protocol (MPP)](https://docs.stripe.com/payments/machine/mpp.md) and, where supported, [UCP](https://docs.stripe.com/agentic-commerce/ucp/stripe-payments-handler.md). This guide explains how to fund those flows with an Issuing card in your Stripe account.

## When this applies

Use this guide when all of the following are true:

- Your agent pays on behalf of your business using Issuing (an `ic_*` virtual card you issue and control).
- The seller supports a Stripe-backed programmatic payment flow. For MPP, its endpoint returns an HTTP `402` with payment requirements. For UCP, its profile advertises the `com.stripe.payments` handler.
- You want a structured integration path—the agent follows a defined protocol instead of parsing checkout pages.

If the seller only supports browser checkout, [retrieve the virtual card credentials](https://docs.stripe.com/issuing/cards/virtual.md#retrieve-virtual-card-details) and use the card directly. The SPT flow below applies only when the seller identifies support for a Stripe-backed protocol.

## Convert the card to a Shared Payment Token (SPT)

Don’t hand your agent the card number or a long-lived payment method. Programmatic flows use a “seller-scoped, amount-limited, time-limited” credential without exposing the underlying card.

A [Shared Payment Token (SPT)](https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens.md) is this credential. You still fund the purchase from your Issuing card, but the seller redeems an `spt_*` scoped to their [Stripe profile](https://docs.stripe.com/get-started/account/profile.md). When the seller attempts payment, the charge runs through your existing Issuing [real-time authorization](https://docs.stripe.com/issuing/agents.md#real-time-authorization) path—before capture and settlement.

An SPT remains usable until it expires, you revoke it, or cumulative captured payments reach `usage_limits[max_amount]`.

## How Issuing controls and SPT limits work together

Issuing card controls and SPT limits solve different problems, and both apply:

| Layer | What it controls |
| --- | --- |
| Issuing card | Baseline spend policy—limits, allowed categories, lifecycle—and whether you approve each authorization in `issuing_authorization.request` webhooks |
| SPT | What a specific seller can charge for this programmatic purchase—amount, currency, and expiration |

Set card-level controls as your ongoing fraud and spend policy. Set SPT `usage_limits` to match the purchase your agent is completing for that seller. An authorization must satisfy both your card controls and the SPT grant.

[Verify webhook signatures](https://docs.stripe.com/webhooks.md#verify-signature) and [allowlist Stripe IP addresses](https://docs.stripe.com/ips.md) on your webhook endpoint so you only approve authorizations from genuine Stripe events.

## What you’ll build

Programmatic payment with Issuing chains three Stripe objects before the agent pays through the protocol (MPP, UCP, or similar):

1. **Issuing card** (`ic_*`): The funding source in your account.
2. **PaymentMethod** (`pm_*`): A buyer-owned clone of the Issuing card in your account, created without exposing the PAN or CVC. The seller never receives this object.
3. **[Shared Payment Token](https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens.md)** (`spt_*`): A scoped grant derived from the PaymentMethod that the agent presents to the seller’s programmatic endpoint.

## Before you begin

- [Issuing](https://docs.stripe.com/issuing.md) enabled on your Stripe account
- A [Stripe profile](https://docs.stripe.com/get-started/account/profile.md) (`profile_*`) for your business and for the seller
- A seller that identifies support for a Stripe-backed programmatic flow, such as [MPP](https://docs.stripe.com/payments/machine/mpp.md) or [UCP](https://docs.stripe.com/agentic-commerce/ucp/stripe-payments-handler.md)
- Preview API version `2026-04-22.preview` for PaymentMethod-from-Issuing-card and SPT requests. See the [private preview release channel](https://docs.stripe.com/sdks/versioning.md#private-preview-release-channel).
- [Private preview access](https://docs.stripe.com/release-phases.md) to create PaymentMethods from Issuing cards. [Contact us](https://stripe.com/contact/embedded-finance) to request access.

## Issue an Issuing card

Issue a virtual card in your account with spend controls that match how your agent spends. These controls remain in effect for every authorization on the card, including payments funded through an SPT.

```curl
curl https://api.stripe.com/v1/issuing/cards \
  -u "<<YOUR_SECRET_KEY>>:" \
  -d "cardholder={{ISSUINGCARDHOLDER_ID}}" \
  -d currency=usd \
  -d type=virtual \
  -d status=active \
  -d "spending_controls[spending_limits][0][amount]=50000" \
  -d "spending_controls[spending_limits][0][interval]=per_authorization"
```

## Create a PaymentMethod from the Issuing card

> This API is in private preview. Without access, we reject `card[issuing_card]` as an unknown parameter.

Use a [restricted API key](https://docs.stripe.com/keys/restricted-api-keys.md) with PaymentMethod write (`payment_method_write`) permission or your account secret key only during development. Clone the Issuing card into a buyer-owned PaymentMethod—still in your account, and not the seller’s:

```curl
curl https://api.stripe.com/v1/payment_methods \
  -u "<<YOUR_SECRET_KEY>>:" \
  -H "Stripe-Version: 2026-04-22.preview" \
  -d type=card \
  -d "card[issuing_card]={{ISSUINGCARD_ID}}"
```

Returns a `pm_*` object in your account.

## Issue an SPT from the PaymentMethod

Use a [restricted API key](https://docs.stripe.com/keys/restricted-api-keys.md) with Shared payment token write (`shared_payment_token_write`) permission or your account secret key only during development. Create an SPT scoped to the seller’s profile and the purchase amount:

```curl
curl https://api.stripe.com/v1/shared_payment/issued_tokens \
  -u "<<YOUR_SECRET_KEY>>:" \
  -H "Stripe-Version: 2026-04-22.preview" \
  -d "payment_method={{PAYMENTMETHOD_ID}}" \
  -d "seller_details[network_business_profile]=profile_test_61TU90nIeGjU7NNVXA6TU90m7ISQWsBxpcx9lASWWXTk" \
  -d "usage_limits[currency]=usd" \
  -d "usage_limits[expires_at]=1798761600" \
  -d "usage_limits[max_amount]=1000"
```

- `payment_method`: The `pm_*` from the previous step.
- `usage_limits[max_amount]`: Maximum spendable amount, in the smallest currency unit (for example, `1000` = 10.00 USD).
- `usage_limits[currency]`: ISO currency code for the limit.
- `usage_limits[expires_at]`: Unix timestamp after which the token can no longer be used.
- `seller_details[network_business_profile]`: The seller’s Stripe business network profile ID (`profile_*`). In test mode, you can use the test profile ID shown above.

Returns an `spt_*` object.

## Present the SPT to the seller

Give the `spt_*` to your agent to present at the seller’s programmatic endpoint. For [MPP](https://docs.stripe.com/payments/machine/mpp.md), the seller responds with an HTTP `402` challenge that includes payment requirements. Your agent retries with the SPT credential to complete payment.

Other Stripe-backed protocols follow their own discovery and credential exchange steps. See the seller’s protocol documentation—for example, the [MPP quickstart](https://docs.stripe.com/payments/machine/mpp.md) or [UCP Stripe Payments handler](https://docs.stripe.com/agentic-commerce/ucp/stripe-payments-handler.md).

## See also

- [Issuing for agents](https://docs.stripe.com/issuing/agents.md)
- [Spend controls](https://docs.stripe.com/issuing/agents.md#spend-controls)
- [Shared payment tokens](https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens.md)
- [Machine Payments Protocol](https://docs.stripe.com/payments/machine/mpp.md)