Vault & Credentials
Credential boundary, payment references, and vault connections.
How Credentials Reach the Merchant
Your VaultSecrets stored at rest
Opaque ReferenceToken replaces raw secret
Credential GrantScoped permission issued
Provider Enforces CapSpend limit applied
Merchant Receives PaymentFunds settle
Payment References
| Label | Provider | Type | Payer | Cap | Status |
|---|---|---|---|---|---|
| Visa ····4f2a | Evervault | Card | person_42 | $200 | Active |
| Mastercard ····91c0 | Basis Theory | Card | person_42 | $500 | Active |
Vault Connections
| Vault | Holds | Topology | Status |
|---|---|---|---|
| Evervault | Cards, Logins | Provider Hosted | Connected Test |
| Basis Theory | Cards | Browser Proxy | |
| AgentCard | Cards | Passkey Approval | |
| Stripe | Cards | Shared Token |
Credential Boundary
Card numbers, passwords, and session tokens never enter model context or API payloads. The platform uses opaque references only. Vault providers hold the secrets. Merchants and agents receive tokenized payment references with per-transaction spending caps.