Create Agentic Tokens

Learn how to create tokens your AI agents can use to make purchases.

How agentic tokens work

Agentic tokens are created for a card you have already issued on Lithic. The cardholder keeps one card, and each agent you connect to it gets its own token in place of the card's number.

For each purchase, you request payment credentials: the token number, expiration date, and a dynamic security code. Your agent enters them at checkout the same way it would enter a card. The card's real number never reaches your agent, which keeps your systems out of PCI scope.

Object	What it is	When you create it
Tokenization	Links a card to an agent configured for your program	Once per card and agent
Payment credentials	The card number, expiration date, and dynamic security code for a purchase	For each purchase
Mandate	Limits on the payment credentials: merchant, amount, frequency, and expiry	With each set of payment credentials

The first time you connect a card to an agent, the card network may ask the cardholder to confirm with a one-time code.

Purchase types and mandates

Set type to describe how the cardholder approved the purchase. Lithic passes it to the card network with the mandate.

`type`	Use when	Example
`HUMAN_IN_THE_LOOP`	The cardholder approves this purchase before the agent makes it	The cardholder asks the agent to buy a specific pair of shoes and confirms the order
`AUTONOMOUS`	The agent decides to buy without asking the cardholder first	The agent reorders milk when the cardholder runs out
`RECURRING`	The cardholder approves a subscription the agent sets up. Create payment credentials once, when the agent signs up. The merchant uses the stored card number for later charges.	A monthly streaming subscription

The mandate records what the cardholder approved:

Field	What to set
`merchant.name`, `merchant.url`	The merchant where the agent will make the purchase
`amount`	The maximum amount in USD cents for each purchase. For `RECURRING`, the maximum for each charge.
`frequency`	`ONE_TIME` for `HUMAN_IN_THE_LOOP` and `AUTONOMOUS`. `WEEKLY`, `MONTHLY`, or `YEARLY` for `RECURRING`.
`expires_at`	When the cardholder's approval ends. For `RECURRING`, set this to when the subscription should stop.

The card network checks each purchase, including renewals, against the mandate and declines purchases that fall outside it.

Before you begin

Issue a card on Lithic for the cardholder. Agentic tokens are created for an existing card.

Contact your Lithic representative to configure tokenization for your program and card network and obtain your configured agent's token.

Subscribe to tokenization.updated webhooks through the Events API to receive activation updates.

1. Connect a card to your agent

Call Create a tokenization for the card, using type: AGENT and your configured agent's token.

POST https://api.lithic.com/v1/cards/16a410c9-7f5c-43e9-8108-bb8a72c063f7/tokenizations

{
  "type": "AGENT",
  "agent_token": "20f418a7-27c2-486c-aeee-3ad2beb87c91"
}

Example 201 Created response:

{
  "account_token": "61c3acef-3c2c-4d61-9352-941397b92ca3",
  "card_token": "16a410c9-7f5c-43e9-8108-bb8a72c063f7",
  "created_at": "2026-10-30T15:00:00Z",
  "device_id": null,
  "digital_card_art_token": null,
  "events": [
    {
      "created_at": "2026-10-30T15:00:00Z",
      "result": "REQUIRE_ADDITIONAL_AUTHENTICATION",
      "token": "a690b617-d3d4-4976-82f6-901f817ad98a",
      "type": "TOKENIZATION_AUTHORIZATION",
      "tokenization_decline_reasons": [],
      "tokenization_tfa_reasons": [],
      "rule_results": []
    }
  ],
  "status": "PENDING_2FA",
  "tfa_methods": [
    {
      "method": "SMS",
      "destination": "XXXX1234"
    },
    {
      "method": "EMAIL",
      "destination": "h***@example.com"
    }
  ],
  "token": "3e9a10da-11be-4a62-a510-d43548bfcec1",
  "token_requestor_name": "Some AI Assistant",
  "token_unique_reference": "V-12345678901234567890123456789012",
  "dpan": null,
  "payment_account_reference_id": null,
  "tokenization_channel": "AGENT_PAY",
  "updated_at": "2026-10-30T15:00:00Z"
}

Save the returned tokenization's token for subsequent requests. Check its status:

ACTIVE: Continue to step 5 to create payment credentials.
PENDING_2FA: Complete steps 2 through 4 to authenticate the cardholder.

2. Select an authentication method

Use the tokenization's tfa_methods to show the cardholder the available methods and masked destinations. Call Select a tokenization authentication method with the selected method, such as SMS or EMAIL.

The card network sends an authentication code to the selected destination.

POST https://api.lithic.com/v1/tokenizations/3e9a10da-11be-4a62-a510-d43548bfcec1/select_tfa_method

{
  "method": "SMS"
}

Example 200 OK response:

{
  "success": true
}

3. Submit the authentication code

Ask the cardholder for the code, then call Submit a tokenization authentication code. Send the code in value as a string to preserve any leading zeros.

POST https://api.lithic.com/v1/tokenizations/3e9a10da-11be-4a62-a510-d43548bfcec1/submit_tfa

{
  "value": "01929"
}

Example 200 OK response when the code is accepted:

{
  "success": true
}

Check success in the response, even when the HTTP status is 200. A value of true means the network accepted the code. A value of false means the code was rejected.

4. Wait for activation

The card network activates the tokenization asynchronously after accepting the code. Wait for a tokenization.updated webhook indicating that the tokenization's status is ACTIVE before requesting payment credentials.

Example activation webhook (excerpt):

{
  "account_token": "61c3acef-3c2c-4d61-9352-941397b92ca3",
  "card_token": "16a410c9-7f5c-43e9-8108-bb8a72c063f7",
  "created": "2026-10-30T15:02:00Z",
  "tokenization": {
    "token": "3e9a10da-11be-4a62-a510-d43548bfcec1",
    "status": "ACTIVE"
  }
}

5. Create payment credentials for a purchase

Call Create payment credentials with the active tokenization. Provide the purchase type, a mandate describing the purchase, and information about the device used for it.

See Purchase types and mandates for how to set type and each mandate field.

This example creates credentials for a one-time purchase of $12.50.

POST https://api.lithic.com/v1/tokenizations/3e9a10da-11be-4a62-a510-d43548bfcec1/payment_credentials

{
  "type": "HUMAN_IN_THE_LOOP",
  "mandate": {
    "frequency": "ONE_TIME",
    "expires_at": "2026-10-31T15:00:00Z",
    "amount": 1250,
    "merchant": {
      "name": "Example merchant",
      "url": "https://merchant.example"
    }
  },
  "device": {
    "ip_address": "192.0.2.1",
    "type": "Mobile",
    "brand": "Example brand",
    "application_name": "Example app"
  }
}

Example 201 Created response:

{
  "token": "da186f0c-535f-4dde-9c4f-a122621a4874",
  "tokenization_token": "3e9a10da-11be-4a62-a510-d43548bfcec1",
  "agent_token": "20f418a7-27c2-486c-aeee-3ad2beb87c91",
  "status": "ACTIVE",
  "type": "HUMAN_IN_THE_LOOP",
  "mandate": {
    "token": "5c988775-c23c-4c43-b2d1-a263515495aa",
    "status": "PENDING",
    "frequency": "ONE_TIME",
    "expires_at": "2026-10-31T15:00:00Z",
    "amount": 1250,
    "merchant": {
      "name": "Example merchant",
      "url": "https://merchant.example"
    }
  },
  "credentials": {
    "value": "4111111111111111",
    "expiration_month": "12",
    "expiration_year": "2027",
    "cvv": "123",
    "expires_at": "2026-10-30T15:13:00Z"
  },
  "created_at": "2026-10-30T15:03:00Z",
  "updated_at": "2026-10-30T15:03:00Z"
}

6. Make the purchase

Give your agent the returned credentials.value as the card number, along with expiration_month, expiration_year, and cvv, to enter at the merchant's checkout. credentials.expires_at tells you when the dynamic security code expires. The mandate's expires_at separately determines when the purchase mandate expires.

📘
The credential value, expiration date, and CVV are only available in the creation response and cannot be retrieved later.