Your real payment details stay with us. Your agent gets mock tokens that work at checkout. Credit cards never enter the agent context, logs, or memory.
An agent browses a product page. The page contains injected instructions. The agent dumps its context to an attacker-controlled endpoint. If your card number was in that context, it's gone.
If the agent is compromised, the attacker gets mock tokens. They are single-use, session-scoped, and expire in 15 minutes. They cannot make a purchase anywhere except through our proxy.
If your agent uses Playwright, it works with Self Agent Pay. The rest is config in the dashboard.
Cards and addresses sit in an encrypted vault. Nothing leaves until a proxy session needs it.
// dashboard.selfagent.pay Card added brand: Visa last4: 4242 exp: 09/28
Each agent card has its own caps and its own kill switch. API keys are issued separately.
POST /v1/virtual_cards
{
"name": "Shopping Agent",
"card_id": "card_1",
"weekly_limit": 200,
"per_txn_cap": 75
}Tokens look like real fields but carry no monetary value. A compromised agent can leak them all day.
await page.fill('#cc', 'SAPu7x2kc1000000'); await page.fill('#name', 'u7x2k_first_name'); await page.fill('#zip', 'u7x2k_bill_zip'); await page.click('#pay');
The real values are injected inside an isolated session the agent cannot observe. The merchant sees a normal transaction.
// inside the proxy (you never see this) const real = await vault.resolve(session, token); request.form.cc = real.cardNumber; await submit(request); // merchant sees: 4242 4242 4242 4242
Three independent controls. The agent is isolated from real values, from other sessions, and from its own spending ceiling.
Mock tokens in the agent's context, real numbers in ours. Substitution happens inside a proxy the agent cannot observe or script.
Agent cards have daily, weekly, monthly, and per-transaction caps. Optional merchant allowlists. Auto-pause on any limit exceeded.
Each agent session runs in its own browser context. Cookies, storage, and cache do not cross between sessions. Tokens are single-use and expire in 15 minutes.
Any workflow that ends in a checkout form works. You decide which agent gets which card, and how much it can spend.
Plus and Pro are in development. Only Free is available today. The comparison below is what each tier will include at launch.
More volume, daily spend limits, and webhook notifications.
Unlimited volume and merchant allowlists for every agent card.
| Feature | Free | Plus | Pro |
|---|---|---|---|
| Payments per week | 2 | 20 | Unlimited |
| Agent cards | 1 | 5 | Unlimited |
| Daily spend limits | — | Yes | Yes |
| Merchant allowlists | — | — | Yes |
| Webhook notifications | — | Yes | Yes |
| Email support | — | Yes | Yes |
| Priority support | — | — | Yes |
Change one import. Keep the rest of your agent code.
import { chromium } from 'playwright'; const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(url); await page.fill('#card', CARD_NUMBER); await page.fill('#name', CARDHOLDER); await page.click('#pay');
import { chromium } from '@selfxyz/agent-pay-playwright'; const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(url); await page.fill('#card', 'SAPu7x2kc1000000'); await page.fill('#name', 'u7x2k_first_name'); await page.click('#pay');
Agent Pay now supports login credentials as well as cards. Save a username and password once, and your agent signs in with mock tokens — your real credentials never enter the agent's context, so a prompt injection can't leak them.
The proxy swaps each token for the real value inside an isolated session, at the moment of submit. Add your logins from the Logins tab in the dashboard.
If something is missing, write to us. We answer honestly, including about what we don't have yet.