Payment Protocol
link.com · by Stripe
The wallet for the AI economy.
Link lets your AI agents spend on your behalf using one-time-use virtual cards or Shared Payment Tokens — without ever exposing your real card details. You approve every purchase. 5 Kings implements Link-based agent-commerce flows for clients building paid-API, B2B-procurement, and booking products.
One wallet. Wherever you check out.
Link is Stripe's consumer wallet — autofill payment details at a million-plus businesses, manage subscriptions, and now give your AI agents a controlled way to spend on your behalf. The same wallet works across cards, banks, crypto, and buy-now-pay-later.
Two credential types, same approval flow
When an agent needs to pay, Link provisions one of two credential types. The real card number is never exposed — the agent only sees a single-use, scoped credential tied to the specific purchase.
Virtual card
A one-time-use card number with CVC, expiry, and billing address. Bound to the specific spend request — if the merchant tries to charge it for anything else, the charge fails.
- Number, CVC, exp_month, exp_year, billing_address returned
- valid_until timestamp enforces single-use window
- Default behavior — works at any merchant that accepts cards
- Output via --output-file with 0600 perms (avoid leaking card data into agent transcripts)
Shared Payment Token (SPT)
A scoped token for merchants that support the Machine Payments Protocol (HTTP 402). The agent passes the token directly to the merchant's API — no card form to fill.
- Provisioned via --credential-type "shared_payment_token"
- Token is bound to the spend request — scoped by amount and merchant
- Works with merchants that implement the MPP / x402 spec at mpp.dev
- Cleaner integration for native agent commerce (no checkout UX required)
From "agent wants to buy" to "you approved"
Every spend request goes through the same six-step flow, regardless of whether the agent is human-supervised or fully autonomous.
Agent initiates a spend request
The agent calls link-cli with the merchant, line items, and amounts. --request-approval triggers a push notification to the user for approval.
Push notification to user
User gets a real-time alert: "openclaw-jane wants to spend $180 at Triplo — Queen room, New Orleans". Approve, deny, or modify the request from the Link app.
Approval status polled
The agent polls --interval with an optional --max-attempts cap. Polling exits only on terminal status: approved, denied, expired, or canceled.
Credential provisioned
On approval, Link provisions a virtual card (default) or a Shared Payment Token (MPP merchants). The real PAN is never returned unless explicitly opted in via --include card.
Agent completes payment
For virtual cards: agent enters card details into the merchant's checkout form. For SPTs: agent passes the token directly to the merchant's x402 endpoint.
Purchase protected
Every purchase through Link is eligible for 90 days of purchase protection: money-back on a better price found later, return-shipping reimbursement, and coverage for loss, theft, or damage.
The CLI that powers every agent
link-cli is the open-source
Stripe-maintained CLI at github.com/stripe/link-cli.
Every command accepts --format [toon|json|yaml|md|jsonl];
non-TTY (agent) calls default to toon — a compact, LLM-friendly text format.
id as payment_method_id).--request-approval triggers push notification + polling.--include card + --output-file for safe handling./mcp (for remote/containerised agents that can't launch a local subprocess).Your real card never leaves the Link vault
Three layered controls keep the real payment credentials out of agent reach. The agent only ever sees a scoped, single-use credential.
Scoped, single-use credentials
Every virtual card is bound to a specific spend request with an amount, merchant, and validity window. Re-use at a different merchant fails. Re-use at the same merchant for a different amount fails.
Explicit user approval
By default, every spend request triggers a real-time push notification. The user reviews the merchant, amount, line items, and shipping address in the Link app before any credential is provisioned.
Card data stays out of agent transcripts
By default, card details are redacted in CLI output — only brand + last4 + expiry are shown. Use --output-file (0600 perms) to write the full card to a local file so the secret never appears in agent logs or LLM context windows.
Three production patterns
Link is the wallet for AI-agent commerce. We build on it where agents need to transact with the real economy.
Travel & booking agents
Booking agents that hold a conversation with the user, find a hotel or flight, get approval, and complete the purchase — using a virtual card scoped to that single booking. The real PAN never leaves Link.
B2B procurement agents
Internal procurement agents that buy SaaS seats, ad spend, or domain renewals under a per-transaction cap with monthly reports. Same virtual-card flow, but the card is issued to the agent identity in the org.
Paid-API / x402 merchants
For merchants implementing the Machine Payments Protocol (HTTP 402), the agent receives a Shared Payment Token instead of a card. One token, one purchase, one merchant — and the agent never needs to fill out a checkout form.
Built for the open agent stack
Link ships first-class support for the protocols and agent runtimes that define the AI economy.
Model Context Protocol
link-cli can run as a local MCP server (stdio) or HTTP MCP server at /mcp. Drop it into Claude, Codex, Cursor, or any MCP-compatible runtime via .mcp.json.
Machine Payments Protocol
For merchants at mpp.dev implementing HTTP 402 Payment Required, Link provisions Shared Payment Tokens natively. No checkout UX required.
LLM-friendly output
Non-TTY calls default to toon — a compact, token-efficient text format. All commands accept --format [toon|json|yaml|md|jsonl].
Questions about Link and agent payments
Is Link the same as Chainlink (the oracle protocol)?
No. Link by Stripe is a consumer wallet + payment-credential product at link.com, used for human and AI-agent checkout. Chainlink is a decentralized oracle network at chain.link, used for bringing off-chain data on-chain. They share no code, ownership, or protocol. 5 Kings does not currently build on Chainlink — this page is about Stripe Link.
Where is Link available?
Link is available in the US (and rolling out to additional markets). link-cli requires a Link account — sign up at app.link.com, then authenticate via the CLI's browser-verification flow. International availability is on the Link roadmap.
What is the difference between a virtual card and a Shared Payment Token?
A virtual card is a one-time-use card number with CVC, expiry, and billing address — used at any merchant that accepts cards by filling out the merchant's checkout form. A Shared Payment Token (SPT) is a scoped token passed directly to a merchant's API — only works at merchants implementing the Machine Payments Protocol (HTTP 402). Virtual cards work everywhere cards work; SPTs are cleaner for native agent commerce.
What is MPP / x402?
MPP (Machine Payments Protocol, at mpp.dev) is the emerging spec for HTTP 402 Payment Required as a first-class payment flow. When an API endpoint returns 402, the client (often an agent) is expected to sign a payment and retry. x402 is the broader term for the same idea. Stripe Link provisions SPTs natively for MPP merchants; OWS (the Open Wallet Standard) handles the crypto-native side via ows pay request.
Do I need a real card to use Link with agents?
Yes — Link is a wallet, not a bank. You fund it with a card or bank account you already own. The agent only ever sees the virtual card or SPT that Link provisions; the underlying funding source stays in the Link vault.
Can an agent spend without my approval?
By default, no — every spend request triggers a push notification and waits for approval. Link's roadmap includes granular agent controls (per-merchant auto-approve, per-amount caps, recurring-purchase approval) which are rolling out. Until those land, the explicit-approval model is the default and we recommend keeping it on for any production deployment.
What purchase protection does Link provide?
Every Link purchase is eligible for 90 days of purchase protection: money-back if you find a better price elsewhere, reimbursement for return shipping and restocking fees, and coverage in the event of loss, theft, or damage. See the full terms for eligibility.
How does 5 Kings use Link in client work?
We implement Link in three patterns: (1) embed link-cli as an MCP server so agents in the customer's stack can request and execute purchases with human-in-the-loop approval, (2) wrap the SPT flow for native x402 commerce (bookings, API purchases, B2B procurement) so the merchant gets a token instead of card data, (3) integrate Link into custom dashboards via the CLI's --format json output. We also contribute upstream feedback where our client work surfaces gaps.
How do I get started?
For a self-serve path: sign up at app.link.com, then run the link-cli quickstart at link-cli quickstart. For an integrated build (MCP server in your agent stack, MPP flows, custom agent policies): book a free call with us.
Ready to wire your agent up to the real economy?
Free, no-pressure call. We will review your current agent architecture, share our honest take on where Link fits (and where you should use OWS, Circle, or a direct Stripe integration instead), and let you decide.
Book a free 30-min call →Install link-cli from github.com/stripe/link-cli · Sign up at app.link.com