You tell your AI agent you want to go to Croatia. It finds the flights, the apartment in Split, and the wine tour in Istria, then stops because it has no way to pay. The answer is not your real card number. Give the agent a single-use virtual card with rules attached, issued fresh for each purchase.
That is what Authoryze does. It is an MCP server that sits between your agent and your money. The agent asks for a purchase, Authoryze checks the request against rules you set, and if it passes the agent gets a single-use virtual card for that one amount. Your real card never enters the conversation. The setup takes about ten minutes, and the steps are below.
Should you give an AI agent your credit card?
Not your real one. An agent that holds your actual card number holds it in its context window, its logs, and whatever tool traces its host platform keeps. If a web page it reads contains a prompt injection, the number can be sent anywhere. If the agent loops on a retry, it can buy the same thing twice. If it misreads a price, nothing catches it. None of these failures need a malicious agent. They are ordinary bugs with your bank account on the other end.
When people ask how to give an agent a credit card, what they usually mean is how to let an agent pay without taking on those risks. That comes down to three things. The agent should never hold a reusable credential. Every purchase should be checked against limits the agent cannot change. And you should be able to see and approve what it buys. A single-use virtual card issued per purchase, with rules enforced on a server the agent does not control, gives you all three. We cover the card mechanics in more depth in how agents pay without seeing your card number.
Give your agent a card in 7 steps
- Create an Authoryze account. Sign up with an email address. Nothing is charged at this point.
- Add a billing card for fees. Authoryze charges 1.5% per transaction with a $0.50 minimum, collected through Stripe. This card only ever pays the fee. It never funds an agent purchase.
- Enroll the card the agent will spend from. Under Payment Methods, enter the Visa or Mastercard you want the agent's purchases drawn against. The card data is tokenized in your browser by Basis Theory and never reaches Authoryze's servers. You confirm it once with a one-time code and a passkey. Every single-use virtual card the agent later receives is issued against this enrollment over Visa Intelligent Commerce or Mastercard Agent Pay. You can reuse the card from step 2 or pick a different one.
- Create an agent. Give it a name. This is the identity your Claude, ChatGPT, or Claude Code session acts as, and every rule and purchase is tied to it. The full API key is shown once on the next screen, so copy it if you plan to connect with a key instead of OAuth.
- Set the rules. This is where the safety lives. You can set an auto-approve threshold, a per-transaction limit, daily, weekly, and monthly caps, a total budget, and a list of allowed or blocked merchant domains. Allowing amazon.com also allows its subdomains. Anything that breaks a rule is denied before a card exists. Anything over the auto-approve threshold comes to you for approval. Every option is listed in the setup docs.
- Optional. Authorize automatic spending. By default, a purchase over your threshold waits for you to approve it. If you want the agent to handle small purchases on its own, authorize an automatic spending envelope on the agent's page. It is an amount cap, one-time or recurring, that the agent can draw against without a tap from you. You confirm it with a passkey, and the rules from step 5 still apply inside it.
- Connect your assistant. Claude and ChatGPT connect over OAuth, so you sign in and pick the agent. Claude Code and Codex can use OAuth or the API key from step 4. Exact commands for each client are in the MCP configuration docs, and the next section covers the common ones.
Once connected, ask your assistant what its spending limits are. If it answers with the caps you set in step 5, the connection works.
Connecting Claude, ChatGPT, or Claude Code
Claude. One connector covers claude.ai, Claude Desktop, and the mobile apps. Click Add to Claude on the docs page, confirm the name and URL Claude shows you, then sign in to Authoryze and choose your agent on the consent screen. In a chat, open the plus menu, choose Connectors, and turn Authoryze on. The Free plan allows one custom connector.
ChatGPT. Open Settings, then Security and login, and turn on Developer mode. Open ChatGPT Plugins, click the plus button, and name the connection Authoryze. Under Connection, paste the server URL from the docs, choose OAuth, and click Create. Sign in to Authoryze and choose your agent. This needs a Plus, Pro, Business, Enterprise, or Edu plan. ChatGPT asks you to confirm each purchase request. Keep that on.
Claude Code. Run the claude mcp add command from the docs in your terminal, then claude mcp login authoryze and sign in when the browser opens. Add --scope user to make it available in every project. If you would rather use the API key from step 4, pass it as a bearer token in the header flag instead of logging in. Check the connection with claude mcp list or /mcp inside a session.
Codex. Same shape. Run codex mcp add with the server URL, then codex mcp login authoryze. The Codex section of the docs also covers the API key path, which reads the key from an environment variable.
Cursor, VS Code, and any other client that speaks Streamable HTTP work too. The docs have a config block for each.
Back to Croatia. With the agent connected, you tell it to book the apartment, the ferry, and the wine tour. Each booking becomes a request. The ones under your threshold go through on their own with a fresh single-use virtual card. The bigger ones show up in your email, and you approve them with a tap. At no point does the agent learn your real card number. If you are still comparing options, the comparison pages cover how Authoryze differs from other agent payment tools.
Common questions
Can I give my agent a virtual card from my bank instead?
You can, and it is better than your real card. But a bank virtual card is reusable, its limits live in an app the agent cannot see, and there is no approval step. Authoryze issues a new single-use virtual card per purchase and checks your rules before the card exists.
Does the agent ever see a card number?
Yes. It sees the single-use virtual card for the one purchase it was approved for, because it needs that to check out. The card is scoped to one amount, can be drawn once, and expires on a short window that comes back with the card itself. Your real card number is never returned through any tool response.
What happens if the agent tries to buy something outside the rules?
The request is denied with a reason, and no card is issued. The agent cannot talk its way around this because the rules are evaluated on the Authoryze server, not in the agent's prompt.
How long does an approval request wait for me?
There's no fixed deadline. The request waits until you approve or deny it from the email or your dashboard. The agent polls for the result and gets a card, or a denial reason, as soon as you decide.
Ready to give your agent a card? Create an Authoryze account and you can have its first purchase approved in about ten minutes.