AI agents acting for users on merchant websites often need card details or login credentials to finish a task. Evervault has launched Browser Tokens to keep that data away from the agent. The product lets AI agents and browser automations make purchases, log in to accounts, and complete sensitive online workflows without exposing payment cards, passwords, or personal data to the agent or the browser provider.
Short-lived tokens replace card data and passwords
Browser Tokens replace sensitive values with short-lived, format-preserving tokens, and agents and browser platforms interact only with those tokens. When a request passes through Evervault’s browser proxy, the original value is restored over the network only for a destination the developer has explicitly approved. Developers can limit each token to approved hostnames and a short expiry period, reducing the risk of an agent disclosing or reusing data elsewhere.
Card tokens remain compatible with common checkout validation, including card-number length, BIN recognition, and Luhn checks. The tokens also work for passwords, so an agent can log in to a user’s merchant account with a stand-in password and pay with a card already saved there. Browser Tokens work with existing browser and automation tools, including Playwright-based environments and hosted browser providers such as Browserbase. Ramp and Natural are among the first customers building with the product.
A network-agnostic route to agentic commerce
Passing raw card details or credentials through an AI model, automation framework, or hosted browser creates security risks and expands the systems subject to PCI DSS and other requirements. Network-led programmes such as Visa Intelligent Commerce and Mastercard Agent Pay offer another route, but availability depends on the card network, issuer, geography, and merchant support. Evervault positions Browser Tokens as a compatibility layer that works with existing cards and account access flows without requiring merchants to change checkout.
Shane Curran, founder and CEO of Evervault, said AI agents will only be useful in commerce if they can act without becoming another place where sensitive data is exposed, and without merchants needing to adopt new agentic payment standards. Walt Leung, co-founder and CPO at Natural, said agents complete checkout with tokenized data and the real card is swapped in only when it reaches the merchant. Browser Tokens are now live for Evervault customers, and new developers can start using them for free.
