Evervault Browser Tokens

Evervault Browser Tokens is a product from Evervault that lets AI agents complete payments and log in to websites without ever handling real card data or passwords. The agent works with tokens, and Evervault swaps in the real values as the request leaves the browser. It is labeled New on the product page.

What It Is

Browser Tokens is a tokenization and proxy layer for agentic browsing. Developers create a token for a card number, CVV, email, phone or password through one API call. The tokens look realistic enough to pass form validation, and the card's BIN and Luhn check are preserved.

How the Workflow Runs

The product page describes three steps. First, create a Browser Token with a TTL, the data to protect, and a permission that names the host allowed to receive the real value. Second, route the Chromium browser's traffic through Evervault's proxy, which is one proxy setting. The browser's trust store also needs Evervault's CA certificate, or intercepted requests fail TLS. Third, the relay swaps the real values into the request, only for hosts on the allowlist. The agent code stays unchanged, and no SDK or merchant integration is required.

Controls and Security Model

Permissions are fixed when a token is created and cannot be widened later. The page lists a hostname allowlist, a TTL per token, data categories, egress type and region as live controls, along with per-session logging of every reveal and refusal. Evervault states that nothing is stored and no token-to-value mapping exists on its side. It also states that it is a PCI DSS Level 1 service provider with SOC 2 Type II. Spend caps, human approval thresholds, a kill switch and merchant category blocks are listed as in progress.

How It Compares

The vendor contrasts Browser Tokens with card network agent protocols, raw card data in the agent, virtual card issuance and browser secret vaults. It says Browser Tokens works with any card that can already pay online and that merchants need not adopt a protocol. It also lists residential and datacenter egress, browser spoofing and anti-bot prevention.