Mastercard Agent Pay — Agentic Token Scope & Consent-Policy Builder

Mastercard Agent Pay lets a verified AI agent transact on a consumer's behalf using an Agentic Token — a tokenised card credential (via MDES) bound to a specific agent, merchant scope, and consent policy, so the model never holds the raw PAN. Build a token scope from a form, or lint one for the bindings and limits that keep it safe.

⚠ Mastercard Agent Pay is recent (announced Apr 2025; first live txn Sep 2025) and the MDES Agentic Token schema is not fully public. Field names here are illustrative — verify against Mastercard developer resources. The scope/consent checks are security properties that hold regardless of exact field names.

Mastercard Agent Pay Agentic Token · MDES Zero PII Client-Side · No Network

Scope & reliance — 🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only. Never enter a real PAN or token. Builds an illustrative scope descriptor and checks consent properties only. Deterministic · zero PII · CC BY 4.0.

▸ Build an Agentic Token scope

Agent ID

Allowed merchants (comma-separated, or * = any)

Per-transaction limit (minor units)

Total / period limit (minor units)

Currency

Expiry (ISO date-time)

Velocity (max txns / period)

MCC allow-list (optional, comma-separated)

▸ Lint an Agentic Token scope

Paste a token scope descriptor (synthetic). Checks agent binding, merchant scope, spend limits, expiry, and velocity. Field aliases accepted.