VGS Goes Live With Agentic Card Tokens Across Visa, Mastercard and American Express, Citing 500,000 a Day
Very Good Security said on 12 November 2026 that its agentic tokens, card credentials bound to a specific AI agent, user and spending scope, are live on Visa, Mastercard and American Express. VGS says it provisions more than 500,000 a day and called Discover a natural next step, without naming customers or a date.
By Daniel Osei, Journalist, Payments and Cards
Very Good Security (VGS) said on 12 November 2026 that it is live with agentic tokens across Visa, Mastercard and American Express, and that it is provisioning more than half a million tokens a day. VGS called Discover "a natural next step" but gave no date.
The company describes itself as the largest independent provider of agentic tokens and says the tokens are already processing real transactions for AI platforms, merchants and fintechs. It did not name any of those customers, and the volume and ranking claims are VGS's own.
What an agentic token adds
An agentic token is a network-issued card credential for an AI agent. VGS puts the difference this way: a network token answers "which card is this?", while an agentic token also answers "what are they allowed to do?"
According to VGS, each token is bound to three things:
Binding — What VGS says it carries
Agent — The identity of the AI agent, so a transaction can be traced to the agent that started it
Scope — Limits on merchants, categories or spending, reflecting what the cardholder authorised
User — User identification and verification requirements, such as passkeys
At checkout the agent obtains a transaction credential, typically the token plus a single-use cryptogram or dynamic code, after consent and authentication checks. The merchant receives the token, never the card number. The network checks the token, the agent and the scope, maps the token back to the card and routes the authorisation to the issuer, which approves or declines. Cardholders can change or revoke permissions, and VGS says the token stops working outside its limits.
Why a middle layer exists
Each network runs its own agentic token programme with its own formats and certification. VGS's pitch is one integration across all three, plus its PCI-compliant vault, so an agent builder or merchant does not maintain a separate connection to each network. It stresses that it is processor-agnostic, not tied to a single payment service provider.
That positions VGS between the networks and the companies building agents, and in competition with processors and issuing platforms that offer agent credentials inside their own stacks. VGS says about one third of US e-commerce relies on its infrastructure, another company figure it does not break down.
Same week, same model
The announcement landed a day before OpenAI launched ChatGPT Wallet, which also relies on network payment tokens so that agents never see card numbers. VGS did not say whether it is involved in OpenAI's wallet, and OpenAI did not name VGS. What both show is that the card industry's answer to agent payments is converging on scoped tokens rather than new payment instruments, with the networks setting the rules and token providers competing to sit in between.
What VGS has not disclosed is how many of its daily tokens are used in completed purchases, which networks carry most of the volume, or which agents and wallets run on it.