Business Wire

Evervault Launches Browser Tokens, Enabling Secure Agentic Payments

Business Wire

AI agents can check out on any merchant web page, independent of all agentic commerce protocols, and without accessing underlying sensitive payment information and credentials

LAS VEGAS, October 20, 2026--Evervault today announced the launch of Browser Tokens at Money20/20, giving developers building agentic commerce products a secure way for AI agents and browser automations to make purchases, log in to accounts and complete sensitive online workflows without exposing payment cards, passwords or personal data to the agent or browser provider.

AI agents increasingly need to act on users' behalf across merchant websites. However, completing transactions often requires access to regulated or sensitive information. Passing raw card details or credentials through an AI model, automation framework or hosted browser can create significant security risks for developers building agentic workflows, and expands the systems subject to Payment Card Industry data security requirements, among other frameworks.

Network-led agentic payment initiatives like Visa Intelligent Commerce and Mastercard Agent Pay offer another route to AI commerce, but availability depends on card network, issuer, geography and merchant support. Browser Tokens provide a network-agnostic compatibility layer for today's web, working across existing payment cards and account-access flows without requiring merchants to adopt a new checkout experience.

Browser Tokens replace sensitive values with short-lived, format-preserving tokens. Agents and browser platforms interact only with those tokens. When a request is submitted through Evervault's browser proxy, the original value is restored over the network only for a destination explicitly approved by the developer.

"Agentic payments are just payments. AI agents will only become useful in commerce if they can act without becoming another place where sensitive data is exposed, and without the need for merchants to adopt one of many new agentic payment standards," said Shane Curran, founder and CEO of Evervault. "Browser Tokens give developers a practical way to use existing cards, credentials and websites while keeping plaintext data out of agents, prompts, logs and browser infrastructure."

Card tokens remain compatible with common checkout validation, including card-number length, BIN recognition and Luhn checks. Browser Tokens also work for passwords, so an agent can log in to a user's account on a merchant site with a stand-in password and pay with the card already saved there.