Stripe's Link Wallet Lets AI Agents Buy Things on Your Behalf

The AI chatbot race just added a new lane: paying for things. An assistant can now complete real purchases on the open web by connecting to Stripe's Link wallet, pulling a fresh single-use card for each transaction, and waiting for a tap of approval before any money moves. It is live for users in the US, with mobile support rolling out.

Connect your Link account, tell the assistant what to buy, and it drives checkout on a merchant's site the way a human would, entering a card number into a form. That card is disposable and scoped to one purchase, so the assistant never sees or stores real payment credentials.

How the plumbing actually works

Under the hood, this rides on infrastructure Stripe shipped earlier this year. The company upgraded Link, its digital wallet that connects payment methods, tracks spending, and manages recurring subscriptions, so agents can now spend on your behalf. When an agent needs to make a purchase, Link issues a single-use virtual card scoped to that specific transaction, the agent presents this card to the merchant, and the user's actual card number, billing address, and CVV are never visible to the agent or to the merchant's checkout flow.

The developer surface is the Link CLI, an open source npm package that also runs as an MCP server so any agent framework can drive it. A typical flow looks like this:

link-cli spend-request create \
  --merchant-name "Stripe Press" \
  --merchant-url "https://press.stripe.com" \
  --context "Purchasing 'Working in Public'..." \
  --amount 3500 \
  --line-item "name:Working in Public,unit_amount:3500,quantity:1" \
  --request-approval

The --request-approval flag pushes a notification to the Link app, the user taps approve or deny, and the agent polls until the request reaches a terminal state. Once approved, the CLI returns a card object with a PAN, CVC, expiry, and billing address that the agent can type into a normal web checkout. A Shared Payment Token path also exists for merchants that speak the emerging Machine Payments Protocol over HTTP 402.

Guardrails baked into the CLI

Stripe has published concrete limits that anyone building on this will hit fast:

• Max amount per spend request: $5,000
• Daily spend: $5,000
• Monthly spend over 30 days: $20,000
• Card validity: 12 hours from request creation
• Approval window: 10 minutes for the user to tap approve
• Rate limit: 50 spend requests per hour, 200 per 60 days

A --test mode returns fake card numbers so you can wire up integrations without moving real money. A --output-file option writes card details to a local file with 0600 permissions, keeping unmasked PANs out of agent transcripts and logs. That last detail hints at how much thought went into what happens when an LLM inevitably tries to print its secrets.

Why this is landing now

The last twelve months of AI product announcements have quietly been an infrastructure buildout for exactly this moment. Stripe announced 288 new products and features at Stripe Sessions, framing agents as economic actors and predicting that agents will account for most online transactions before long. The card networks came along too: Visa is working with OpenAI, Microsoft, Anthropic, Stripe and Samsung on tokenized agent credentials, and Mastercard shipped its own Agent Pay product last year.

The competitive picture is getting crowded. Stripe is helping OpenAI launch Instant Checkout in ChatGPT, where US users can buy goods from US Etsy sellers and, soon, over a million Shopify merchants, directly in the chat. Perplexity now competes head-on with OpenAI, which launched Instant Checkout in late September. Amazon is defending its turf aggressively, suing Perplexity to stop its Comet agentic browser from shopping on users' behalf while adding agentic shopping features to its own Rufus chatbot, where customers can ask Rufus to monitor products and buy when an item hits a target price, with a 24-hour cancel window.

Two bets on how agentic commerce works

Two schools are forming. One says the merchant's checkout page is the interoperability layer, and agents should just type a card number into a form the way a human does. Link plus a virtual card delivers that: it works on any site that accepts Visa, no merchant integration required. The other school says the merchant should expose a machine-readable payment endpoint, which is what the Agentic Commerce Protocol that Stripe and OpenAI codeveloped and the Machine Payments Protocol over HTTP 402 provide.

Approach	Merchant work	Coverage
Virtual card into web form	None	Any Visa-accepting site
Shared Payment Token via API	Integrate SPT	Partner merchants only
Machine Payments Protocol	Implement HTTP 402 flow	MPP-enabled sites

The virtual-card path is the pragmatic answer while the protocols catch up. It also puts pressure on retailers trying to block agent traffic: bot-detection stacks cannot easily tell whether the browser filling out the checkout form is a human or an assistant using a real, valid Visa card.

What is now possible

For anyone building agents, payment is no longer a hard stop. Until recently, agents could research, plan, and cart items, then hand off to a human for the last mile. With a Link-issued card, an autonomous workflow can go end to end. Some concrete things this unlocks:

1. Reorder flows where a coding agent renews an expired API subscription without a human in the loop for micro-payments
2. Personal assistants that book flights, hotels, and rides across sites that never integrated with any specific AI vendor
3. Multi-agent architectures where each agent gets its own scoped card and budget, so a marketing bot literally cannot touch the infra billing card
4. Merchant-agnostic shopping agents that do not depend on being on a partner list

Risks worth watching

Prompt injection is the elephant. An agent that can be talked into buying things by a hostile web page is a new class of attack surface, and the current mitigation is the human tap on the approval notification. That works as long as users actually read the merchant name and amount, which historically is not what humans do with push notifications. The 10-minute approval window and per-request cap are real backstops, but $5,000 buys a lot of surprise sushi.

Liability is the other open question. If an agent buys the wrong item, or gets tricked into buying the right item at the wrong store, the dispute chain runs through the user's underlying card issuer, and the industry is still figuring out how to attribute charges to a specific agent identity rather than just to the human on the account. Mastercard's Agent Pay tries to encode agent identity in the token itself, and Stripe's roadmap points at similar guardrails for agent identity and scope enforcement, though the norms are not settled.

The practical takeaway is that the checkout button is no longer the boundary of what an AI assistant can do. If your product depends on humans finishing purchases on merchant sites, the assumption that a human is on the other end of the checkout form is now the thing to question.