> ## Documentation Index
> Fetch the complete documentation index at: https://docs.natural.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> When building application code, use `@naturalpay/sdk` for TypeScript or `naturalpay` for Python.
> When operating Natural directly for a user, use the payments MCP at `https://mcp.natural.com`.
> When searching Natural documentation, use the docs MCP at `https://docs.natural.com/mcp`.
> Use the Natural CLI for terminal and CI automation.
> Use REST only for unsupported languages or when the user explicitly requests raw HTTP.
> Start integration development and testing in the sandbox. Do not use production unless the user explicitly requests it.
> For sandbox requests that require `customerPartyId`, list customers first. Reuse only the intended fixture; otherwise create a customer.
> REST and SDK amounts use integer minor units. Payments MCP amounts use decimal strings with a required currency code.

# Overview

> Let agents pay with a card without handling the real card number

Agents can't handle a real card number (PAN) without coming into PCI scope. Agent checkout lets an [agent](/guides/concepts/agents) pay with a user's card while it only ever sees a credential that's limited to one purchase.

Pick a method by how the user approves spending and how the merchant takes the card:

| Method | Approval | The agent receives | Saved cards | Natural-issued cards |
| - | - | - | - | - |
| [Browser tokens](/guides/concepts/browser-tokens) | The user approves each purchase | A stand-in card and a browser proxy login | Available | Coming soon |
| [Agent tokens](/guides/concepts/agent-tokens) | The owner approves a budget (mandate) once | A tokenized card issued for the purchase | Available | Coming soon |
| Single-use virtual cards | Coming soon | A one-time card number | Not supported | Coming soon |

Browser tokens and agent tokens are for agents: call them with an [agent key](/guides/concepts/agent-keys) and the `X-Instance-ID` header.

## Choose a method

Use browser tokens by default, and switch to agent tokens when a browser token can't complete the checkout.

**Browser tokens** work at most checkouts, and the owner doesn't need to create a mandate on the dashboard first. Whether the user is needed depends on the card:

* **Saved cards:** the user approves every purchase and types the card's security code (CVV) each time. Only use a browser token when the user can respond during checkout.
* **Natural-issued cards** *(coming soon)*: no approval step for each purchase.

**Agent tokens** need a mandate the owner created and verified with their card issuer on the dashboard. Once it's active, the agent can pay within the budget without the user. Use agent tokens when:

* **The checkout doesn't send the raw card number.** The proxy swaps in the real card only when the stand-in number appears in the checkout's HTTP request. If the page encrypts or tokenizes the card in the browser first, such as inside a payment provider's iframe, the swap can't happen and a browser token can't pay.
* **The user can't approve each purchase** while paying with a saved card.

If the agent has no active mandate, ask the owner to create one on the dashboard.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.