Is Stripe Issuing for agents safe to connect to an AI agent?

What an AI agent can do

• Live vs paper: live, by application (apply in the Stripe Dashboard; platforms contact Stripe); the agents page doesn't mention a test mode source
• Order approval: spend limits per authorization or over a period (for example monthly) and allowed merchant categories, set per card or cardholder and applied by Stripe at authorization; real-time authorization webhooks let your own code approve or decline every charge (2-second default timeout, then the card's default rules apply); single-use cards are invalidated after use; a card can be frozen at any time source
• Markets: virtual and single-use cards, Shared Payment Tokens for MPP and UCP checkouts, agentic network tokens (Visa, Mastercard)
• Pricing: not stated on the agents page

Safeguards that exist

• Paper, demo or testnet mode: Issuing has test-mode helpers to simulate card authorizations in a sandbox (official docs) source
• Withdrawal permission needed or allowed: Agents only get card credentials (single-use cards or SPTs) with spend limits, MCC controls and real-time approval; no payouts (official docs) source
• Scoped keys, permission scopes or IP whitelisting: Restricted API keys with per-resource None/Read/Write permissions are recommended for AI agents (official docs) source

Safeguards that are missing

• Can it place live orders unattended?: Can place live orders with no documented approval step source
• Order approval or confirmation options: No approval or limit option in our listing source
• Open source or audited: No public source code in our listing source

Sources

• https://docs.stripe.com/issuing/agents
• https://docs.stripe.com/api/issuing/authorizations/test_mode_create
• https://docs.stripe.com/keys/restricted-api-keys

Full listing: Stripe Issuing for agents · How the score works: Safety score method