Agentic Tokens
Definition
Agentic Tokens are a category of secure payment credentials, issued by card networks, designed specifically for transactions initiated by an AI agent rather than a person typing in their card details. Mastercard uses Agentic Tokens as the brand name for its own mechanism, part of its broader Agent Pay program; Visa pursues an equivalent approach through its Trusted Agent Protocol and Intelligent Commerce Connect.
The underlying idea is similar to the tokenization already used for contactless and mobile payments: the agent and the merchant never see the actual card number, only a token tied to a specific transaction, with its own authorization rules. This lets a bank or card network distinguish a legitimate agent-initiated purchase from a stolen card being used fraudulently, which matters as more purchases happen without a person directly entering payment details themselves.
These tokens typically work alongside authorization protocols such as the Agent Payments Protocol (AP2), which defines what the person actually authorized, and purchase protocols such as ACP or UCP, which carry the purchase itself. A first production example in Europe came from Worldline, ING, and Mastercard, where an agent autonomously completed a concert-ticket purchase using this kind of secured token.
In Europe, delegating a card payment to an agent this way also raises questions under PSD2/PSD3 about strong customer authentication, an open regulatory question that sits alongside the technical one. See the Agentic Commerce and Agentic Checkout entries for the wider purchase journey these tokens settle.
Examples
A person's bank card is set up with a Mastercard Agentic Token inside a travel-booking agent. When the agent books a flight within the limits the person set, the airline's payment system receives only the token, not the actual card number, and can verify it was authorized for that specific agent and purchase.
Worldline, ING, and Mastercard demonstrated a production transaction in Europe in which an agent autonomously purchased a concert ticket, using a secured token rather than the buyer's raw card details, as an early proof point for the broader model.
Frequently Asked Questions
Are Agentic Tokens the same thing at Mastercard and Visa?
Not exactly. Agentic Tokens is Mastercard's own brand name for its mechanism, part of its Agent Pay program. Visa pursues an equivalent goal through its Trusted Agent Protocol and Intelligent Commerce Connect. Both aim to let an agent pay securely without exposing the real card number.
How do Agentic Tokens relate to AP2?
AP2 defines and verifies what a person authorized an agent to do, such as a spending limit. Agentic Tokens are the payment-network mechanism that carries out an actual card transaction once that authorization exists, keeping the real card number hidden from the merchant and the agent.
Has an agent-initiated payment with these tokens already happened in production in Europe?
Yes. Worldline, ING, and Mastercard demonstrated a production transaction in which an agent autonomously bought a concert ticket using a secured token of this kind, an early but real example rather than a lab demo.
What regulatory question do Agentic Tokens raise in Europe?
Delegating a card payment to an agent raises questions under PSD2/PSD3 about strong customer authentication: regulators and banks need a way to confirm the person genuinely authorized the agent to spend, which is the same question AP2's mandates are designed to answer.
