AI agents can check out on any merchant web page, independent of all agentic commerce protocols, and without accessing underlying sensitive payment information and credentials
Evervault announced the launch of Browser Tokens at Money20/20, giving developers building agentic commerce products a secure way for AI agents and browser automations to make purchases, log in to accounts and complete sensitive online workflows without exposing payment cards, passwords or personal data to the agent or browser provider.
Read More on Fintech : Global Fintech Interview with Shai Gabay, CEO at Trustmi
AI agents increasingly need to act on users’ behalf across merchant websites. However, completing transactions often requires access to regulated or sensitive information. Passing raw card details or credentials through an AI model, automation framework or hosted browser can create significant security risks for developers building agentic workflows, and expands the systems subject to Payment Card Industry data security requirements, among other frameworks.
Network-led agentic payment initiatives like Visa Intelligent Commerce and Mastercard Agent Pay offer another route to AI commerce, but availability depends on card network, issuer, geography and merchant support. Browser Tokens provide a network-agnostic compatibility layer for today’s web, working across existing payment cards and account-access flows without requiring merchants to adopt a new checkout experience.
Browser Tokens replace sensitive values with short-lived, format-preserving tokens. Agents and browser platforms interact only with those tokens. When a request is submitted through Evervault’s browser proxy, the original value is restored over the network only for a destination explicitly approved by the developer.
“Agentic payments are just payments. AI agents will only become useful in commerce if they can act without becoming another place where sensitive data is exposed, and without the need for merchants to adopt one of many new agentic payment standards,” said Shane Curran, founder and CEO of Evervault. “Browser Tokens give developers a practical way to use existing cards, credentials and websites while keeping plaintext data out of agents, prompts, logs and browser infrastructure.”
Card tokens remain compatible with common checkout validation, including card-number length, BIN recognition and Luhn checks. Browser Tokens also work for passwords, so an agent can log in to a user’s account on a merchant site with a stand-in password and pay with the card already saved there.
The product works with existing browser and automation platforms, including Playwright-based environments and hosted browser providers like Browserbase. Developers can restrict each token to approved hostnames and a short expiration period, reducing the risk that an agent can disclose or reuse sensitive data elsewhere.
Ramp and Natural are among the first customers building with Browser Tokens.
“Agents complete checkout with tokenized data, and the real card is only swapped in when it reaches the merchant,” said Walt Leung, Co-founder and CPO at Natural. “That’s what lets agentic commerce scale on today’s web, without waiting for every merchant to adopt new protocols.”
Catch more Fintech Insights : Why Security, Compliance and Resilience Must Advance Together in Financial Services
[To share your insights with us, please write to psen@itechseries.com ]
