ChatGPT Wallet lets AI agents pay for purchases without exposing the real card

OpenAI introduced on November 13, 2026 the ChatGPT Wallet, a digital wallet that lets an artificial intelligence agent carry out payments on behalf of the user. The tool was born out of a partnership with American Express, Mastercard and Visa and solves a problem that stalled any serious attempt at purchase automation: how to let an agent pay without handing over, to it or to the store, the real card data.

OpenAI's answer follows a logic already familiar to anyone who works with payments: tokenization. Instead of number, security code and expiration date, what circulates in the transaction is a token generated by the payment network itself (Amex, Mastercard or Visa) after the user authorizes the purchase. The physical card never appears to the agent or to the merchant.

How the authorization flow works

Access to ChatGPT Wallet starts with dots, OpenAI's AI agent. The user registers an eligible card, and from there, each purchase goes through an explicit confirmation flow before any charge.

The process has fixed steps:

1. The agent assembles the purchase (products and total amount).
2. The user reviews items, amount and which card will be used.
3. Approval requires biometric verification, via facial recognition or fingerprint.
4. Each approved authorization generates a record of the transaction.
5. The payment network issues the token that replaces the real card data in the final charge.

The merchant continues to receive the charge on the card chosen by the user, with the usual benefits and dispute protections. In short: the buyer keeps control of the payment method, and the seller keeps control over price, delivery, returns and support, according to OpenAI.

Who can already use it (and who can't)

The launch is restricted. ChatGPT Wallet is in an early testing phase, available only to ChatGPT Pro subscribers over 18 years old in the United States, with eligible cards issued in the country. OpenAI describes the stage as a pilot run together with companies, banks and payment networks before any expansion.

For the Brazilian developer, this means there is, for now, no integration available with local card brands like Elo, nor any mention of payment methods like Pix (Brazil's instant payment system). The initial bar is the US, an American card, a paid ChatGPT subscription. Those following the movement from here are, at this moment, watching from the outside.

The guide for businesses: the part that matters to builders

The most relevant part of the announcement for developers is not the wallet itself, it's the material that comes with it: an OpenAI guide to help businesses adapt their sites and systems to commerce carried out by AI agents.

The document covers three technical fronts, according to the source:

• Agent access to site pages, that is, how to structure content so an agent can reliably navigate and extract information.
• Availability of up-to-date information about products, prices and availability, the kind of data that today is normally exposed only to the human user via interface, not to an automated consumer.
• Integration with payment systems and fraud prevention, adapting checkout to recognize and process transactions initiated by an agent instead of by a direct human click.

In practice, this pushes e-commerce and marketplace teams to treat the AI agent as a traffic channel with its own requirements, similar to the effort that already existed to open order APIs to third-party apps, except now on the consumer side, not the business-partner side.

Purchase delegation: the next step (not yet available)

OpenAI states that it intends, in future stages, to allow the user to delegate purchases to the agent with predefined parameters, such as spending limit, allowed product categories and specific time windows. In this model, the transaction would be pre-authorized, with additional security mechanisms, including biometric verification and a record of granted permissions.

This is the difference between authorizing purchase by purchase, which exists now, and giving the agent a budget and a scope to operate on its own within rules, which does not exist yet. This is the point that actually changes the product's category: it goes from "assistant that facilitates the purchase" to "agent that actually buys within a limit," something closer to what a payment-systems architect would call a delegated authorization flow.

What remains open

The source does not detail technical protocol, API format, or how the integration guide technically connects to the merchant's checkout, it only describes the three fronts of adaptation. There is also no indication of a timeline for expansion outside the United States, nor of when Brazilian card brands or banks might join the pilot.

For those building an online store or marketplace in Brazil, the movement does not yet demand immediate action, but it signals a direction: checkout designed only for a human click will, at some point, also need to respond to an agent that arrives without going through the visual interface, with a token in place of the card and an authorization record instead of a browser session.