Evervault launches tokens that keep card data from AI agents

On 20 October 2026, Evervault launched Browser Tokens at the Money20/20 show in Las Vegas. The tool lets AI agents pay for items and use accounts without access to card numbers or passwords. The agent gets a token, which is a temporary value that replaces the card data. Evervault says it works on a merchant web page with no new checkout standard.

How it works

Browser Tokens replace sensitive values with tokens that expire after a short time. The agent and the browser platform see only the tokens. A message goes through the Evervault browser proxy, a server in the middle. The proxy puts back the card data only for a destination that the developer permits.

The numbers

Evervault gave no test results and no sales numbers. The card tokens keep the length of the card number, the BIN (the first digits that name the card issuer) and the Luhn check (a digit test). Checkout pages accept them. Ramp and Natural are customers.

What is not known

No other group has tested the claims. Evervault says Visa Intelligent Commerce and Mastercard Agent Pay are not open to all cards, regions and merchants. The company did not say which merchants it tested.

Insight: Three firms hide card data from AI agents

Amex (13 October) uses a token at checkout. Self Labs (15 October) enters the card number only at payment. Evervault adds a token for a web page. This reads as a race to own the layer between agent and card. The first layer that developers use can set the rules. Leaders must pick a layer before agents pay at scale.