Issue a single-use virtual card with a spend limit for an agent purchase

Steps

1. Authenticate to your card issuing platform (e.g., Stripe Issuing) using a server-side API key scoped to card creation only — never embed this key in the agent runtime.
2. Create a virtual card with type=single_use, a spending_controls object that sets spending_limits (amount + interval=all_time), and optionally locks allowed_categories to specific MCC codes relevant to the purchase.
3. Set the card expiration to the shortest window that covers the transaction — 15–60 minutes for synchronous purchases, longer only if the checkout flow is asynchronous.
4. Pass the card PAN, expiry, and CVC to the agent in a short-lived, in-memory context; do not log these values anywhere.
5. After the charge is attempted, poll the authorization events on the card; once a successful authorization appears (or the card expires), mark the card record as consumed in your own DB.
6. Reconcile the authorization amount against the intended purchase amount; if they differ, trigger an alert and initiate a review before settlement.