What Is a Shared Payment Token (SPT) for Agentic Commerce?

Short answer: A Shared Payment Token (SPT) is a scoped, single-use payment credential that lets an AI agent pay a merchant on your behalf without ever seeing your real card or bank number. Your payment provider issues the token after you approve a purchase, and it is bound to four things: the merchant, a maximum amount, a short expiry (often minutes), and single use. The agent passes that token to the merchant, who runs it through their normal processor. Stripe introduced SPT as part of the Agentic Commerce Protocol it co-developed with OpenAI, and it now powers Instant Checkout in ChatGPT.

Last updated July 2026.

The problem SPT solves

When an AI agent buys something for you, the old options were both bad. Either you handed the agent your actual card number, which is a credential it could reuse anywhere and a real liability if the agent is hijacked, or you sat in the loop typing card details into every checkout, which defeats the point of an agent. A Shared Payment Token is the middle path. You authorize a specific purchase once, and the agent receives a token it can only use for that purchase. Your card number, expiry and CVC never reach the agent or the merchant.

Think of it like a valet key. The full key starts the car and opens the trunk and the glovebox. The valet key starts the car and nothing else. An SPT is the valet key for one transaction: enough to complete the purchase you approved, useless for anything else.

What an SPT is bound to

The scoping is the whole point. When you agree to a purchase inside an assistant such as ChatGPT, your payment provider issues a token locked to four properties, and the merchant's processor rejects it if any of them do not match.

Because the token carries these limits itself, the merchant does not need to trust the agent. The merchant just receives a token and runs it through the same processor it already uses for card payments. If the amount, merchant or timing is off, the payment simply fails.

How an SPT payment flows, step by step

The sequence is short. First, you ask an agent to buy something and it finds the item at a merchant. Second, the agent shows you what it wants to buy and the price, and you approve. Third, your payment provider issues a Shared Payment Token bound to that merchant, that amount, a minutes-long expiry and single use, without revealing your underlying card. Fourth, the agent hands the token to the merchant as part of checkout. Fifth, the merchant runs the token through its normal payment processor and the charge settles against your real payment method behind the scenes. You get the goods, the merchant gets paid, and neither the agent nor the merchant ever held your card number.

SPT vs a raw card number vs a scoped issued card

Shared Payment Tokens are one of several ways an agent can pay. They are not the same as issuing the agent its own virtual card, and they are worlds apart from giving it your real card.

Shared Payment Tokens shine for consumer-style, one-off purchases an assistant makes with your explicit per-purchase sign-off. Scoped issued cards, covered in our piece on Stripe Issuing for agents, fit programmatic, repeated spend where a business, not an individual, sets the policy up front.

Where SPT sits in the wider agentic commerce stack

SPT is a payment primitive, not a spend-governance system. It answers "can the agent complete this one purchase safely" for a consumer approving each buy. It does not answer "is my business allowing this agent to spend at all, up to what budget, with which vendors, and where is the record." Stripe has said it is extending SPT to work with network programs such as Mastercard Agent Pay and Visa Intelligent Commerce and with buy-now-pay-later methods, which tells you SPT is meant to be the plumbing many players share, not a control plane any one buyer runs.

That distinction matters most when the buyer is a company rather than a shopper. A person approving a single dinner order in ChatGPT is a fine use of SPT. A finance team letting fifty agents place hundreds of purchases a day needs something above the token: per-agent limits, human approval over a threshold, and one audit trail across every rail. That is the line between agentic checkout and agent spend governance.

Where Agentspay fits

Agentspay is the governance layer that sits above whatever payment primitive an agent uses, including a Shared Payment Token. When your agent proposes a purchase, Agentspay checks it against your policy first: is this agent allowed to spend, is the amount within its budget, is the counterparty permitted, has it crossed a threshold that needs a human to approve. Only then does the purchase go through, whether it settles via an SPT, a network token, or a scoped virtual card you issued. Every one of those events lands in an immutable, agent-attributed audit trail. SPT protects the credential on a single buy; Agentspay decides and records whether that buy should happen at all. When those purchases hit your books, you can pull the line items off each purchase receipt automatically so reconciliation is not a manual chore.

Frequently asked questions

What is a Shared Payment Token?

A Shared Payment Token is a scoped, single-use payment credential that lets an AI agent pay a merchant on your behalf without exposing your real card or bank number. Your payment provider issues it after you approve a purchase, bound to one merchant, a maximum amount, a short expiry and single use, so a stolen token is nearly worthless.

Who issues a Shared Payment Token?

The buyer's payment provider issues the token, not the agent and not the merchant. When you approve a purchase inside an assistant such as ChatGPT, your provider mints a token bound to the merchant, amount and expiry, and the agent passes that token to the merchant, who runs it through its usual processor. Your underlying card details stay hidden.

Is a Shared Payment Token the same as a virtual card?

No. An SPT is a single-use token for one approved purchase at one merchant, typically minted after a consumer approves each buy. A scoped virtual card is a card your platform issues with its own limits, better suited to programmatic, repeated spend where a business sets policy up front. Both hide your primary card, but they serve different buyers.

Does an SPT control how much an agent can spend overall?

Not on its own. An SPT caps the amount of the single purchase it is issued for, but it does not enforce a budget across many purchases, require human approval over a threshold, or keep one audit trail. Those are spend-governance jobs, which sit above the payment primitive, in a control plane like Agentspay.

The takeaway

A Shared Payment Token is a clean answer to a narrow question: how does an agent pay a merchant without holding your card number. It is scoped, short-lived and single-use, and it makes consumer agentic checkout much safer. It just is not a spend policy. If your agents are transacting at any real scale, pair the payment primitive with governance that decides and records every purchase. See the Stripe agentic alternative, read how agent-to-agent payments work, or see how Agentspay works.