Payment tokenisation · Mastercard · Live to all US cardholders November 2025
Mastercard Agent Pay
Agent-native tokenised payment infrastructure built on Mastercard's existing tokenisation rails. Includes Mastercard Agentic Tokens for binding agents to individual users.
Abbreviation: Agent PayMastercard Agent Pay is the agent-native tokenised payment infrastructure built on Mastercard's existing tokenisation rails. Live to all US cardholders since November 2025, Agent Pay represents the most production-ready payment-layer protocol in the agentic commerce stack.
The centrepiece of Agent Pay is the Mastercard Agentic Token - a unique token per AI agent per user that prevents token sharing or misuse. Unlike traditional payment tokens that are bound to a device or a card, Agentic Tokens are bound to a specific agent-user relationship. This means a consumer's shopping agent carries a different token than their travel agent, even when both are authorised to use the same underlying payment card.
Agent Pay integrates with Microsoft Copilot Checkout as the first major agent platform deployment, uses Ethoca real-time dispute data for agent transaction dispute resolution, and leverages Mastercard Threat Intelligence for security and fraud prevention. The Cloudflare Web Bot Auth integration - co-developed with Microsoft, Shopify, Adyen, and Worldpay - provides the agent verification layer.
For merchants, Agent Pay solves the delegation design problem at the payment layer: how does a payment network bind an agent to a specific user's authority, with appropriate spending limits and scope constraints, while maintaining the dispute resolution and fraud protection infrastructure that consumers expect?
How does a payment network bind an agent to a specific user's authority?
What Agent Pay provides
Mastercard Agentic Tokens: unique token per AI agent per user, preventing token sharing or misuse
Microsoft Copilot Checkout integration via Copilot agent payment infrastructure
Ethoca real-time dispute data for agent transaction dispute resolution
Mastercard Threat Intelligence for security and fraud prevention in agent transactions
Cloudflare Web Bot Auth integration (co-developed with Microsoft, Shopify, Adyen, Worldpay)
Before you begin
The following must be in place before starting Agent Pay integration. Missing prerequisites are the most common cause of delayed or failed protocol deployments.
Cloudflare account or Web Bot Auth SDK implementation
PSP supporting Agent Pay (Stripe, Adyen, Worldpay all support it)
Token management infrastructure for Mastercard Agentic Tokens
Dispute handling infrastructure compatible with Ethoca data
What goes wrong
These are the failure modes the AXD Institute has observed across early Agent Pay implementations. Each includes the root cause and the recommended mitigation.
Token scope misconfiguration
Agentic Tokens carry specific spending authority. Tokens configured with incorrect spending limits or scope create either overly permissive or overly restrictive agent behaviour.
Web Bot Auth integration gaps
Cloudflare Web Bot Auth must be correctly integrated before Agent Pay tokens can be issued. Incomplete integration causes all agent checkout attempts to be rejected.
Dispute data integration
Ethoca real-time dispute data must be integrated into your dispute handling workflow. Without this integration, agent-initiated disputes follow the slower standard dispute resolution path.
Step-by-step walkthrough
A sequenced implementation guide for Agent Pay. Each step includes the action, the rationale, and the validation criteria for completion.
Cloudflare Web Bot Auth integration
Cloudflare Web Bot Auth must be correctly integrated before Agent Pay tokens can be issued. This is the foundational layer - incomplete integration causes all agent checkout attempts to be rejected.
- •If you already use Cloudflare, enable the Web Bot Auth module in your Cloudflare dashboard.
- •If you do not use Cloudflare, implement the Web Bot Auth SDK in your checkout infrastructure. The SDK is available for major web frameworks.
- •Configure Web Bot Auth to classify incoming traffic into three categories: human, verified agent, and unverified bot.
- •Test the classification accuracy with known agent traffic patterns. False positives (legitimate agents classified as bots) prevent Agent Pay from functioning.
PSP configuration for Agent Pay
Configure your payment service provider to support Mastercard Agentic Tokens. Stripe, Adyen, and Worldpay all support Agent Pay.
- •Contact your PSP to enable Agent Pay support. The configuration process varies by provider.
- •Implement the Agentic Token acceptance flow in your checkout: when an agent presents an Agentic Token, your checkout must validate it through your PSP's Agent Pay integration.
- •Configure spending authority validation - Agentic Tokens carry specific spending limits and scope. Your checkout must verify that the requested transaction falls within the token's authority.
- •Test token validation with your PSP's sandbox environment before production activation.
Agentic Token scope configuration
Define the spending authority and scope constraints for Agentic Tokens accepted by your checkout. Token scope misconfiguration is the most common Agent Pay failure mode.
- •Define acceptable token scopes for your business: maximum transaction value, product category restrictions, frequency limits.
- •Implement scope validation in your checkout flow. Tokens configured with incorrect spending limits create either overly permissive or overly restrictive agent behaviour.
- •Configure scope escalation handling - what happens when an agent attempts a transaction that exceeds its token scope? The recommended pattern is to return a structured scope-exceeded response that the agent can present to the user for re-authorisation.
- •Document your scope configuration for compliance purposes. In regulated industries, token scope definitions are auditable artefacts.
Ethoca dispute data integration
Integrate Ethoca real-time dispute data into your dispute handling workflow for agent-initiated transactions.
- •Configure Ethoca data feeds for agent-initiated transactions. Without this integration, agent-initiated disputes follow the slower standard dispute resolution path.
- •Implement real-time dispute notification handling - Ethoca provides dispute signals before they become formal chargebacks.
- •Build agent-specific dispute analytics: are agent-initiated transactions generating more or fewer disputes than human-initiated transactions? This data informs your token scope configuration.
- •Ensure your dispute handling workflow correctly attributes disputes to the agent-user pairing rather than just the payment card.
Production activation and monitoring
Activate Agent Pay in production and implement monitoring for token usage, scope violations, and dispute patterns.
- •Activate Agent Pay through your PSP's production configuration.
- •Implement TEI (Trust Erosion Index) monitoring for agent-initiated payment sessions.
- •Track Agentic Token usage patterns: successful transactions, scope violations, expired tokens, and dispute rates.
- •Monitor DCR (Delegation Completion Rate) for payment-specific delegation - what percentage of agent-initiated payment attempts complete successfully?
- •Schedule a 30-day review to assess token scope configuration effectiveness and adjust based on observed transaction patterns.
Related metrics, frameworks, and essays
AXD Metrics Standard KPIs
AXD Practice Frameworks