Authoryze

Authoryze is a payment authorization service for AI agents. Agents request purchases through MCP tools, Authoryze evaluates them against owner-defined rules, and approved purchases receive a single-use Mastercard or Visa credential so the owner's real card is never exposed to the agent.

What It Is

Authoryze sits between an AI agent and a real funding source. An agent calls request_purchase with a merchant, amount, description and justification. The request is auto-approved, denied, or routed to a human for review, and only then can the agent draw a one-time card to complete checkout.

How the purchase flow works

The MCP server exposes request_purchase, check_status, retrieve_card, report_purchase_outcome and get_spending_summary. Approved requests are retrieved once, with draw-once enforcement, and the agent reports whether checkout completed. Idempotency keys let agents retry safely without a duplicate card or fee. Card data is drawn on demand and not stored by Authoryze; only the last four digits and a provider token are kept.

Controls and audit

Owners set per-transaction, daily, weekly, monthly and total limits per agent, plus aggregate caps across all agents. Merchant allowlists and blocklists match subdomains, auto-approve thresholds send larger purchases to review, and rules are enforced server-side. Every request, approval, denial and card issuance is recorded in a dashboard audit trail.

Connecting clients

Claude, ChatGPT, Claude Code, Codex and Cursor connect over OAuth, and VS Code is also documented. Headless or custom agents use a per-agent API key as a bearer token. The documentation states card issuance is US-only today and enrollment is limited to Visa and Mastercard; Privacy.com is supported as a secondary funding rail.

Security limits

The docs state that the agent does see the single-use card details and that prompt injection is not prevented; the design instead bounds the damage to one approved transaction.