OpenAI rolls out ChatGPT Wallet with tokenized card payments for agents
OpenAI has begun rolling out ChatGPT Wallet, a payment feature that lets ChatGPT agents complete purchases using a tokenized card number rather than exposing a user’s underlying card details. The company developed the wallet with American Express, Mastercard and Visa. Its initial availability is limited to eligible users in the United States.
The design addresses a central trust issue in agent-assisted commerce: an AI agent may need to carry out a transaction, but should not need access to the customer’s actual payment credentials. According to OpenAI, the agent and merchant do not receive the user’s card details. Instead, the payment network issues a token that acts as a substitute card number and has its own security code and expiration date.
How a wallet purchase works
A user adds a payment card to the wallet once. Before each purchase, the user reviews the items, total and selected card, and approves the transaction with Face ID, a fingerprint or a similar check. After approval, the payment network provides the token used for the charge, which is applied to the real card behind it.
OpenAI says purchases continue to use the card’s existing rewards and protections for eligible disputes. The token is intended to work with current checkout flows, so merchants do not necessarily need to replace their payment infrastructure to accept a transaction. That does not guarantee every checkout will succeed: a site’s fraud controls or other defenses may reject an agent-driven purchase.
The user approval step is a notable part of the flow. The agent can handle checkout activity, but the customer is asked to confirm the specific purchase details before payment. This gives the customer a chance to check the basket and amount rather than treating the agent’s ability to shop as blanket authorization for all transactions.
Merchant defenses may need adjustment
OpenAI has published a Commerce Partner Playbook outlining steps for merchants. It recommends configuring a content delivery network or firewall to recognize Web Bot Auth, a method for verifying signed requests from bots. The playbook also advises merchants to work with their payment and risk providers to identify agent purchases.
The challenge is that automated activity can be either legitimate or abusive. Retailers that block automated checkout may unintentionally stop a customer-authorized agent. At the same time, existing fraud systems may treat an unfamiliar agent transaction as suspicious, resulting in a decline or cancellation. Merchants therefore need ways to distinguish authorized agent activity from unwanted automation without weakening protections against fraud.
OpenAI says it is working with fraud-prevention vendors Forter, Riskified, Sardine and Signifyd, as well as payment providers Adyen, Checkout.com and Stripe. The wallet’s use of existing checkout flows may reduce the need for merchants to rebuild payment systems, but risk decisions made by systems in front of those flows remain a potential obstacle.
Limited initial availability
At launch, access is restricted to ChatGPT Pro subscribers in the United States who are at least 18 years old and hold eligible cards issued in the United States. The announcement does not establish broader availability beyond that initial group.
Luke Gebb, who leads global innovation at American Express, described the wallet as the company’s “first American Express Agentic Commerce Experiences integration.” The participation of major card networks and payment providers places the launch within an emerging effort to support purchases initiated by software agents while keeping payment credentials separated from those agents.
For enterprise security and identity teams, the rollout highlights an operational distinction: authenticating a customer and authorizing a particular payment are different controls. The wallet’s flow combines a network-issued payment token with user confirmation for each purchase, while merchants must decide how to recognize and assess the agent activity that reaches their checkout systems. The effectiveness of the model will depend in part on whether those merchant-side controls can accept legitimate transactions without losing the ability to detect abuse.
