# Evervault Browser Tokens: Agentic payments on any website > Source: > Published: 2026-10-23 17:17:49+00:00 # Let your AI agents pay anywhere, # without ever seeing card data. Card numbers, CVVs, passwords: your agent only ever uses tokens. We swap in the real values once the request leaves the browser. oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## Three steps, start to finish. ### Create a Browser Token One call, and not just for cards. Card number, CVV, and password. All come back looking real enough to pass the form, with the card's first six digits intact. ### Route your browser's traffic through us One proxy flag. Your agent runs exactly as it does now, and only ever sees the tokens. ### We swap in the real values As the request leaves the browser, the real value goes in, at the host you allowed and nowhere else. oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## Pick a task, see it run. oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## If it's Chromium, it works. We sit on the network, not in your browser. Nothing to fork, nothing to wrap. oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## One API call, one proxy setting. No SDK to adopt, no checkout to rebuild, nothing for the merchant to install. Your agent code stays as it is. Add our CA certificate to the browser’s trust store, or intercepted requests will fail TLS. It’s one line in the quickstart. ## Built for the web that already exists. How today's agentic payment options compare, and why we built Browser Tokens. ##### Agentic tokens and protocols Visa Intelligent Commerce and Mastercard Agent Pay work only when the user’s bank and the merchant both support them, and most don’t today. Each card network is a separate integration. ##### Browser Tokens One integration, for any card that can already pay online. Merchants don’t have to adopt a protocol or rebuild their checkout. ##### **Raw card data in the agent or browser** Hand the agent the card, and it can end up in prompts, logs, or on a webpage built to trick the agent. It also puts your agent, your model, and your browser provider in PCI scope. ##### Browser Tokens The agent, the browser, and your logs only ever see tokens, so they stay out of PCI scope. Evervault handles the real card in its own PCI Level 1 environment. ##### **Virtual card issuance** The user loses the rewards on their own card, coverage stops at the regions the provider supports, and the extra steps slow down a flow the agent is meant to finish on its own. ##### Browser Tokens The agent pays with the user’s own card. Already issuing virtual cards? Tokenize those too, and the agent never sees the card number. ##### **Browser secret vault** A browser vault keeps the card out of the agent’s prompt, but it puts the browser provider in the sensitive data path, and the agent can still leak values through the Chrome DevTools Protocol. ##### Browser Tokens The browser only ever holds tokens. The real value appears in our proxy, and only for hosts you’ve allowed. oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## Your agent submits forms as normal. ###### Residential IPs Traffic comes from ordinary home connections, not obvious data center addresses. ###### Browser spoofing The browser looks like a regular visitor's, not an automated one. ###### Anti-bot prevention Built to avoid the usual bot checks, so your agent isn't turned away. oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## We can't leak what we don't keep. Nothing is stored. No mapping from the token back to the real value exists on our side, so there is no vault to breach. ###### What you set hostname allowlist LIVE TTL LIVE data categories LIVE egress type and region LIVE human approval thresholds NEXT kill switch NEXT merchant category blocks NEXT spend caps NEXT oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## Live today. More on the way. ### Live PCI DSS Level 1 service provider SOC 2 Type II. Your agent never touches card data, so scope is reduced Tokens for card number, CVV, email, phone and password BIN and Luhn preserved, so merchant forms validate Permissions fixed when the token is created They can't be widened later, not by your code and not by the agent oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ###### Trusted by ## Agentic commerce builders oe44kqinic85uzpg00sbcd7vmzyy3tvpbgrr4lvyijndc9c38rfnoi4r169b5yy0cyhxqysg076aqqbjlm5ttmd2k5b9nufvhn2qrpz93d4yv2tjbaepa6visu1uanuxzfq4bw9dp07si4fybq9xzkb0izxpm90t2te3ro2oaogmu1vfkgu6z14kw3tz4egcnckd9s ## Agents complete checkout with tokenized data, and the real card is only swapped in when it reaches the merchant. That’s what lets agentic commerce scale on today’s web, without waiting for every merchant to adopt new protocols. ###### Walt Leung, Co-founder and CPO at natural ## Plans & Pricing ### Browser Tokens Sandbox apps are free subject to fair use. On the Pro plan, production apps pay $0.25 per card session and $0.05 per credential session. Requires an Evervault account. ## $0.25/card #### $0.05/credential session #### Each session includes 25MB free #### Bring your own proxy #### Residential proxies extra # Your agent gets a token. The destination gets the real value. ## Frequently Asked Questions © 2026 Evervault Inc. All rights reserved.