A
Account holder
The person who owns the Agent Vault account and its cards. Also called the owner. Only the account holder adds cards, sets agent card rules, approves held purchases and signup requests, enters live security codes, and completes challenges. An agent never acts as the account holder.Activity feed
The dashboard’s record of what your agents did. The Activity page lists sessions and notification events: fills, refusals, approvals, challenges and key activity. Recording is best effort, so a gap is possible. Session records are kept for 30 days. See Activity.Agent
The AI program that shops or signs in on your behalf. Any program that drives the proxied browser through the Playwright SDK or the MCP server with one of your API keys. It holds only mock tokens, never real card numbers or passwords.Agent card
A set of spending rules you attach to one of your real cards. A rules object pointed at a funding card: spending limits, merchant rules, an approval threshold, a webhook and a pause switch. It holds no card number. Several agent cards can govern one funding card. At fill time the fill is permitted if any active agent card permits the merchant. The limits of every agent card that permits the merchant and is active or stopped at its limit then apply. One you paused yourself lends no limits. See Agent cards.Agent-created login
A website account that an agent opened for you, with your approval. A login created through an approved signup request. The vault generates its password, so the agent never sees it. Only the key that created it may set its username once and rotate its password, for seven days after it was created by default, and only until the account holder replaces the password themselves.ambiguousOnly
A flag meaning the page might be asking for a code, but the evidence is weak.
A challenge detection result where the only signal is a field that might be a
code input, judged from the current sign-in’s recent fills. It is not handoff
material: requestChallengeHandoff() refuses it with handoff_not_applicable.
anySite
A catalog flag meaning a card is not limited to a list of sites.
Set on a card in the token catalog that no agent card governs,
or that an active agent card in allow-all or blocklist mode governs, so a catalog
narrowed by URL returns it for every host. A card whose agent cards are all
paused or at their limit carries neither anySite nor websites, and fills
nowhere until one is resumed. It does not promise the fill will succeed: a blocklist card carries it too,
and its excluded hosts are refused at fill time with merchant_blocked. A site
that is not an authorized destination is refused with destination_unauthorized.
API key
The credential your agent uses to connect to Agent Vault. A key created on the API keys page and sent as a bearer token. It authenticates proxy sessions and API calls, and can be limited by a scope and granted the signup permission. An unknown key and a revoked key are indistinguishable to the caller (invalid_api_key).
Approval threshold
A dollar amount above which a purchase waits for your approval. TheconfirmAbove setting on an agent card. A fill for a total at or above it is
held until the account holder approves or denies it, for up to 5 minutes. A
checkout whose total cannot be read is always held when a threshold is set. See
Approvals and notifications.
Attested detokenization
An optional mode that reveals a card only inside verified secure hardware. Revealing a card number only inside a hardware-attested confidential computing enclave. Off by default, and non-functional without a provisioned enclave. See Attested detokenization.Auto-pause
An agent card setting that stops the card when a limit is hit. TheautoPauseOnLimit setting, on for every agent card created in the dashboard.
While it is on, any breach of the card’s own limits, including a per-transaction
one, changes the card’s status to limit, and it stops filling until resumed.
With it off, the breaching fill is refused and the card stays active.
B
Binding checks
Final safety checks run just before a card number is typed. After a card is revealed and before it is typed, the vault token’s owner must match the card’s account, and the revealed last four digits must match the card’s. A failure iscard_blocked, and nothing is typed.
Blackout
The black image every screenshot becomes after the first fill. Theredaction value on a screenshot taken after any token fill in a session.
The whole image is a solid black rectangle. It is not a dark page or a failed
render. Only a new session clears it. See Redaction.
Blocklist
An agent card rule that allows every merchant except the ones you list. A merchant mode, available on every plan. The listed hosts are refused withmerchant_blocked, and are never shown to the agent. See Merchant
rules.
C
Challenge
A security step only a person should complete, such as a bank check or CAPTCHA. 3-D Secure, a one-time code, a CAPTCHA, or a silent block (blocked). The proxy
detects and classifies these and never solves them. The agent hands off instead. The one
exception is the authenticator step of a sign-in for a login with a stored
TOTP secret. See Handling challenges.
Challenge handoff
Passing the live page to you so you can complete a challenge yourself. Streaming the agent’s live page to the account holder, who completes the challenge. While it runs, every other page call from the agent is rejected, so the agent cannot watch what is typed. Afterwards, in a session with no token fill, screenshots are not blacked out, so a page that echoes what was typed stays protected only if the agent does not capture it. See Agent context. The agent waits up to about 10 minutes, then resumes on the same page. Different from a purchase approval, which is a yes or no decision.Checkout recipe
A saved description of how a store’s checkout works. A JSON document in the recipe registry describing a platform’s or merchant’s checkout: detection signals, where the card fields are, a step per phase, gotchas and any dead end. See Recipe format.Corroboration
The checks run before a checkout counts as confirmed. Whatget_session_outcome checks before recording a confirmation: the submit
control has left the page, no popup is waiting, no error or challenge is showing,
and the success marker is still present. See Confirming
outcomes.
Cross-user denial
A refusal because a token belongs to a different account.cross_user_denied: the user id inside a token does not match the API key’s
account. Three within five minutes revoke the key automatically
(key_auto_revoked).
CVV
The card’s security code, which Agent Vault never stores. The mockcvv token in the catalog has nothing stored behind it. Filling it
starts live CVV entry on a deployment that offers it, and
otherwise fails with cvv_entry_required. See
CVV policy.
D
Dead end
A store where an agent can never complete checkout on its own. Thedead-end recipe status, with a deadEnd.type saying why: turnstile,
captcha, paypal-only, login-wall, 3ds, stripe-config or
automation-blocked. Recording one is as valuable as recording a success. See
Recipe statuses.
E
Extra websites
Additional sign-in addresses you allow a login to fill on. Hosts the account holder authorized for a login whose sign-in redirects to a different domain, listed asextraWebsites in the catalog. They match exactly,
unlike website, which also matches subdomains. Only the account holder can add
one.
F
Fill
Typing a value into a field on a web page. An SDK or MCP call that types into a form field. When the value is a mock token, the proxy substitutes the real value inside its own browser and runs every check at that moment. See fill-time substitution.Fill-time substitution
Real values are swapped in at the very last moment, inside Agent Vault’s browser. A mock token becomes its real value only inside the proxy’s browser, as it goes into the field. Every policy check (site, account, scope, merchant rules, destination, limits, approval) happens at that moment. A failed check is a refusal with a code, and nothing is typed. A failure after typing starts, such asfill_rejected, can leave part or all of the value on the page.
Fingerprint
A product URL with the private parts removed. The scheme, host and path of a URL, with the query, the fragment and any hosted-checkout session token removed. The only form of a URL to send to the recipe registry. The SDK’sfingerprintUrl() produces it from an absolute URL,
and returns a string that does not parse unchanged.
Funding card
A real card you added, which merchants actually charge. A payment card the account holder added in the dashboard. Its number is stored in the vault, never on an Agent Vault server (the proxy uses it for one fill, and keeps it in memory until the session closes only to scrub it from agent-facing output), and it is what the merchant charges. Governed by zero or more agent cards. With none, it can be used for any amount on any authorized destination, even when the total cannot be read. The plan’s payment quota still applies. See Cards.H
Handoff
See Challenge handoff.I
Identity
Your name, email and phone details, as tokens. The identity entries in the token catalog: first name, last name, full name, email and phone, plus phone parts.phone is in E.164 form, such as
+15550100134, except for an older phone stored as free text, which fills as
typed until the account holder saves it again. They resolve on any
authorized destination. default is the account
profile. The account holder can add more, each under its own label such as
work, and each appears in the catalog.
inconclusive
A flag meaning a page scan did not finish.
Set on observe() and detectChallenge() results when the scan did not
complete. Every false beside it means unknown, not absent. A finished scan
omits the flag, so test !result.inconclusive.
L
Live CVV entry
You type the security code yourself while the checkout waits. Live CVV entry is a per-deployment capability. Where it is offered, filling thecvv token pauses the checkout, and the account holder enters the real code from
their dashboard for that one fill. The agent never sees it. If it is not entered
within about 3 minutes, the fill fails with cvv_entry_required. On a deployment
without it, the fill fails with cvv_entry_required at once, and no prompt is
raised. See Live CVV entry.
Login
A saved website username and password. A credential record in the vault with awebsite, optional extraWebsites, a
password, and optionally a username, email and TOTP secret. It fills
only on its registered site. See Logins.
M
MCP server
The Agent Vault tool server for AI assistants. A Model Context Protocol server that exposes Agent Vault as tools (open_page,
fill_checkout, get_token_catalog and others) to any MCP client. See MCP
setup.
Merchant
The online store an agent buys from. In recipes and rules, a merchant is identified by its host, for exampleshop.example.com.
Merchant recipe
A recipe describing one specific store. A recipe withkind: "merchant", naming the store’s hosts, the platform recipe
it uses, any selector overrides and any dead end. See Recipe
format.
Merchant rules
Which stores an agent card may be used at. An agent card’s merchant mode: Allow all, Blocklist (any merchant except the listed hosts, every plan) or Allowlist (only the listed hosts; choosing or editing it needs Enterprise, and one set before a downgrade stays enforced). A refusal ismerchant_blocked in both list modes, so the agent cannot map your
settings.
Mock token
A stand-in value the agent uses instead of real card or login details. A string such asav_card_1_number_u7x2k that the agent fills in place of a real
value. Stable and never expiring while the record or field behind it exists, and
useless outside the proxy: anywhere else it is just text. See
Token grammar.
N
Network tokenization
Using card-network tokens instead of card numbers. Not active. Support for scheme-issued network tokens exists in the data model but is inactive: no card carries one, and cards are filled with their card number. See Card storage.O
One-shot authorization
Permission for exactly one security code fill, right after the card number. Filling a card number arms a single authorization for the security code that follows. The next action on the page uses it up. Reads such as screenshots,observe() and count() do not, except a screenshot that returns
securityCodeAuthorizationReleased: true. Then fill the number again before the
code. Something in between means a second approval.
P
Page hint
Telling Agent Vault where something is on the page. A declaration of where something is, never what it is. Used to point at an order total the vault cannot find, or at anotpauth:// code during 2FA setup.
See Page hints.
Partial
A recipe status: the card fields were reached and filled on a real run. Thepartial recipe status. A real checkout reached a filled card form. No
purchase was completed.
Phantom spend
Spending that counts against a limit even though no order was placed. A card fill whose order never completed. It still counts against the agent card’s spending windows until they roll past it, because a fill is recorded the moment it lands.Plan quota
The usage allowance that comes with your plan. Account-level limits set by the plan: payments per rolling 30 days and the number of agent cards linked to a funding card that still exists. Reaching one givesplan_quota_reached. See Limits and
timeouts.
Platform recipe
A recipe describing how a whole store platform’s checkout works. A recipe withkind: "platform", for example Shopify or WooCommerce, shared by
every store on that platform. Changes are reviewed by a maintainer.
Playwright SDK
The code library for driving Agent Vault from your own program. The@agentvault/playwright package. It mirrors Playwright’s API but runs the
browser inside the proxy. See Install the SDK.
Precondition
A step a store requires before checkout, which an agent can complete. A clearable gate recorded on a recipe:delivery_location, region_select or
account_required for checkout. Unlike a dead end, it does not make the store
unusable.
Proxy
Agent Vault’s secure browser service, where real values are typed. The service that runs the browser the agent drives, substitutes real values for mock tokens at fill time, and enforces every rule. The agent talks to it over a WebSocket.Proxy session
One browser run, from launch to close. The browser, its tabs and its cookies inside the proxy. It ends after 15 minutes idle or 60 minutes in total, and starts with an empty profile every time. See Sessions and timeouts.Purchase approval
A yes or no decision you make on a held purchase. A held fill at or above an agent card’s approval threshold, waiting up to 5 minutes for the account holder to approve or deny it. Different from a challenge handoff, where the account holder completes a step on the live page.R
Receipt
A screenshot of an order confirmation, kept with the session. A redacted image of a confirmation page stored on the session record. It is stored only when no sensitive value was filled anywhere in that session.Recipe registry
The shared, public library of checkout recipes. The open registry of checkout recipes, readable without an API key atGET /v1/recipes and grown through screened submissions. See
Checkout recipe registry.
Recipe status
How much has been proven about a recipe. One ofverified, partial, unverified or dead-end. See Recipe
statuses.
Related login
A login you have on another part of the same website. A login registered on a sibling host of the same site as the URL the catalog was narrowed to. It carries hosts only, no tokens, and will not fill on the page you are on: navigate to itswebsite.
Run report
A summary of what a session did, without any values. The proxy’s own record of a session: which token kinds were filled, how many fills were refused, whether a confirmation was recorded, and the order total. Kinds and counts, never values.S
Scope
The list of cards and logins one API key may use. An API key’s allowlist of card and login records. Unset means all, an empty list means none, and a list means only those. A record outside it is refused withscope_denied.
Signing secret
The secret that proves a webhook came from Agent Vault. A per-agent-card secret startingwhsec_, created when the first webhook URL is
saved. It keys the HMAC-SHA256 signature in X-AgentPay-Signature. See
Webhooks.
Signup permission
Permission for an API key to request new website accounts. A per-key setting, off by default, that lets an agent file signup requests and maintain the logins it created. Without it, those calls fail withsignup_not_enabled. See Agent signup.
Signup recipe
A recipe describing a website’s account signup form. A recipe withkind: "signup" or "signup-platform". It describes a form and is
not permission to create an account. See Signup
recipes.
Signup request
An agent’s request to open a website account for you. A request filed withPOST /v1/logins/requests or createLogin(). It usually
starts pending and creates nothing until the account holder approves it, and
expires after 24 hours. For a site and email on the holder’s
Pre-approved signups list, it starts approved and the login already exists. At most five can wait at once per account.
Spending limit
The most an agent card may spend in a period. Per transaction, per day (Plus and Enterprise), per week and per rolling 30 days, in US dollars, set on an agent card. Every window is rolling. A breach is refused withlimit_reached. Unmetered deployments (preview, development, test and staging)
enforce only the per-transaction cap.
T
Token catalog
The list of mock tokens your agent may use. The tokens one API key may use, plus the non-sensitive details needed to choose between them. Safe to give an agent. See Token catalog.TOTP
The six-digit codes from an authenticator app. Time-based one-time password (RFC 6238). The only second factor Agent Vault can complete without a person: the backend derives the current code from the stored secret and sends only that code to the proxy, which types it into the site. The proxy and the site receive the code; the agent and the account holder never see it. A secret already stored never leaves the backend. The one exception is enrolment by an agent: the site shows the newotpauth:// secret
on a page the proxy is rendering, and the proxy reads it there and sends it to
the backend to encrypt. The agent never receives it. See
TOTP.
Tunnel
A route that makes the browser’s traffic leave from your own machine. A connection back through the agent’s machine, so merchants see that machine’s IP address instead of the proxy’s. Used by default when available. SetSELF_AGENT_PAY_TUNNEL=1 to require it. See Egress and
tunnelling.
U
unanswered
The proxy stopped waiting for one call. The session is still fine.
Not terminal: the session, its pages and its cookies are intact. Contrast
request_timeout, the SDK’s own deadline, which closes the session.
Unverified
A recipe status: worked out from the platform, but never run. Theunverified recipe status. Derived from the platform’s known structure and
never tested on this store.
URL locking
Each saved login fills only on its own website. A credential resolves only where it is registered. Logins fail closed: they fill only on theirwebsite, its subdomains and exact extraWebsites. Cards resolve
wherever their agent card rules allow, and only on an authorized
destination. See URL locking.
V
Vault
The secure store where your card numbers are kept. Cards are tokenized in the account holder’s browser by the vault provider’s iframe, so the number never reaches the Agent Vault backend. The proxy types it for one authorized fill, and keeps it in memory until the session closes only to scrub it from agent-facing output. See Card storage.Verified
A recipe status: a real purchase was proven with a receipt. Theverified recipe status. A real purchase completed, proven out of band by a
merchant receipt or card statement. Only a maintainer can set it. A confirmation
page is not proof.
W
Webhook
A message Agent Vault sends to your server when something happens on an agent card. A signed HTTPSPOST to the endpoint set on an agent card, for fills, refusals,
limit events, auto-pause and held purchases. Plus and Enterprise only. See
Webhooks.