ChatGPT Wallet Lets Agents Pay Without Card Details

Posted on by
Contents show
ChatGPT Wallet

ChatGPT Wallet is the first wallet that lets an AI agent complete a purchase without ever seeing the user's actual card details, and it ships with a security check on every single purchase. Built in partnership with American Express, Mastercard, and Visa, it rolls out first through dots for ChatGPT Pro subscribers in the United States, and it turns the checkout step of agentic shopping into something that looks almost ordinary: the user reviews the items, the total, and the card, approves with Face ID or a fingerprint, and a payment token stands in for the real card number at the merchant. Card rewards survive, dispute protections survive, and the merchant never receives anything but a tokenized credential. With 1.2 billion people using ChatGPT each week and a large share of them already asking it to research and compare products, ChatGPT Wallet answers the question that has stalled agent commerce until now: who actually pays, and how does the user stay in control. This piece breaks down how a ChatGPT Wallet purchase works, what businesses must change to accept agent payments, and where the limits sit today.

How a ChatGPT Wallet purchase actually works

The flow has four steps, and each one is designed around a single principle: the agent proposes, the user disposes. First, the user adds a card once through a secure form, entering the card number, expiration date, and security code outside the chat entirely, with bank verification following if the issuer requires it. Second, when the dot finds something to buy, the user reviews the items, the total, the selected card, and any shipping or recurring payment terms before anything is charged. Third, the user approves with a biometric security check such as Face ID or Touch ID, creating a clear record of exactly what the agent was authorized to purchase. Fourth, the payment network generates a payment token, a substitute credential with its own card number, security code, and expiration date, and checkout completes against that token while the real card details stay sealed. Users can start the enrollment either by asking the dot to add a card or through the Wallet section of the settings page, and both paths lead to the same secure form.

The use cases OpenAI demonstrates are everyday errands rather than exotic automation: asking the dot to help find a new sweater, or to book a hotel for a trip, and when it is time to check out, the dot prompts ChatGPT Wallet setup if the user has not enrolled yet. The design bet is that the hard part of agent shopping, choosing well, is what the model is good at, and the risky part, paying, is what the wallet makes explicit and revocable.

The token design is what separates ChatGPT Wallet from simply storing a card in a profile. The number entered at checkout differs from the number on the physical card, so a merchant breach or a curious agent cannot leak the underlying account. The charge lands on the card the user selected, which means existing rewards programs and the card's dispute protections for eligible cases, such as a defective item, carry over untouched. Users transact directly with businesses, and businesses keep their customer relationships along with control over pricing, fulfillment, returns, and customer service. OpenAI is not inserting itself as the merchant of record; it is brokering the authorization moment. That positioning matters for adoption, because banks and networks already know how to underwrite card present and card not present transactions, and ChatGPT Wallet slots into the existing evaluation machinery instead of asking the industry to learn a new one.

Recurring payments get their own warning, and it is worth repeating: if the user approves a purchase that includes a recurring or continuous payment plan, the merchant may store the payment credential and charge it again under the terms the user agreed to. ChatGPT Wallet makes the approval screen the contract, which is why the review step lists recurring terms explicitly rather than burying them in a receipt.

What the agent can and cannot do

The capability boundary is drawn tightly at launch. ChatGPT Wallet works in conversations with a dot, the agent surface that shops on the user's behalf, and it is not available in Chat, Work, or standalone Codex threads. Users must be 18 or older, live in the United States, hold a US billing address, and use an eligible US-issued American Express, Chase, Mastercard, or Visa card, with Chase cards requiring primary cardholder status. Virtual cards are not supported at enrollment, which is distinct from the virtual card number ChatGPT Wallet itself generates for each approved purchase. Your bank may also ask you to verify the card during setup, through a code or an approval inside the bank's own app, and enrollment is complete only when ChatGPT Wallet reports the card was added.

Within a purchase, the agent can check availability, manage a cart, and complete checkout after ChatGPT Wallet approval, and the user can ask the dot to manage saved cards, switch defaults, or remove a card by its last four digits. Outside a purchase, the agent has no standing payment authority. There is no auto-approve mode at launch, no spending budget that lets the agent charge without a biometric check, and no way for the agent to read or re-enter card details, because those live in the secure enrollment form and are exchanged only for tokens at the network level.

The roadmap OpenAI describes points at delegated purchasing: users eventually setting parameters such as spending limits, purchase categories, or time periods, and pre-approving purchases that fit inside them with enhanced safeguards layered on today's biometric checks and authorization records. That is the version of agent commerce where ChatGPT Wallet becomes infrastructure rather than a checkout button, and the staged launch exists to learn from real use before the delegation model goes live. The shopping visibility problem that precedes payment, where sites reject agent traffic before checkout even starts, is covered in the AI shopping errors that send buyers elsewhere, and wallet adoption will inherit every one of those failure modes unless merchants fix them.

What businesses need to change

Alongside ChatGPT Wallet, OpenAI published a Commerce Partner Playbook, and its three workstreams describe exactly where agent purchases fail today. The first is product information: businesses claim their business in ChatGPT, and once verified, update details and upload a product feed with current pricing and availability, so agents quote accurate data instead of stale or hallucinated figures.

The second is access. Websites need to ensure agents are not inadvertently blocked, configuring CDN or firewall rules to recognize signed requests using Web Bot Auth and checking that general security measures are not rejecting ChatGPT agents. Browser access requires no plugin and no product feed, which lowers the bar considerably: a merchant that fixes its bot rules can accept agent driven shopping without building anything. This is the same visibility checklist that payment-capable agents make urgent, because a blocked agent is now a blocked customer holding a ChatGPT Wallet payment method.

The third is payments and risk. Wallet tokens work with existing checkout flows, but risk engines may still flag legitimate purchases made by agents, producing declines or cancellations that look identical to fraud. OpenAI is working with fraud prevention partners including Forter, Riskified, Sardine, and Signifyd, and payment service providers including Adyen, Checkout.com, and Stripe, so their systems recognize legitimate ChatGPT Wallet purchases. Merchants can also go further, building plugins that let agents check availability or manage carts through existing systems, or adding WebMCP tools that expose structured actions to the agent.

The commercial logic for merchants is straightforward. Every declined agent purchase is a customer who researched the product, picked the item, and was stopped at the register by a risk rule. The playbook exists because that outcome is common, avoidable, and now directly measurable.

The security model, piece by piece

The security model of ChatGPT Wallet stacks five independent controls, and each covers a different failure mode.

Card detail isolation is the base layer: card numbers are entered only in a secure form, never in chat, and never shared with the business or the agent, which neutralizes prompt injection attempts that try to make the agent reveal credentials. ChatGPT Wallet extends this isolation to merchant communications, because the token is the only credential that ever leaves the wallet boundary.

Per purchase biometric approval is the second layer of ChatGPT Wallet, requiring Face ID or Touch ID on a supported device for every transaction, with a fallback path through a linked device when the current one cannot verify, including continuing approval on a supported phone if the computer's lid is closed or the device lacks biometrics. Because approval creates an authorization record of the exact items, total, and card, disputes start from evidence rather than memory.

Tokenization at the network is the third layer, replacing the real card with a payment token per use, so the credential exposed at any merchant is bounded and revocable by design. If ChatGPT Wallet detects a problem, the exposure is a single token rather than the underlying account, and the issuer's existing controls apply to it like any card credential.

Explicit trust boundaries for the user are the fourth: the Help Center guidance tells users to decline any request they do not recognize, verify merchants before approving, contact card issuers promptly about unrecognized charges, and never share full card numbers, security codes, passwords, or verification codes in chat or support messages. Bank verification happens in official banking apps, not in conversation, and the guidance repeats that verification codes belong only in secure forms. Chase cardholders get a specific flow: install the Chase app, sign in with biometrics, and approve the wallet connection inside the bank's own environment, scanning a QR code when starting from a computer.

Division of support responsibility is the fifth: merchants handle order status, cancellations, returns, and refunds; card issuers handle declined, pending, disputed, or unrecognized charges; OpenAI handles wallet errors and suspected account compromise. That division mirrors how card networks already allocate liability, which shortens the learning curve for banks and merchants alike. Removing a saved card follows the same disciplined pattern: identify the card by its last four digits, confirm the removal message names the right card, and verify by listing saved cards again, knowing that removal does not cancel existing purchases or close anything with the bank.

For users of adjacent OpenAI services, it is worth noting that ChatGPT Wallet's approval model rhymes with the platform's wider agent posture, including the controls described in the API usage limits and pro tier breakdown: capability ships with an explicit control surface rather than a blanket permission.

Where the limits are today

The constraint list is longer than the feature list, which is honest for a first release. Geographic and issuer availability is narrow: US Pro subscribers only, eligible US-issued cards only, 18 and over only, with Amex, Chase, Mastercard, and Visa at launch and bank verification gatekeeping individual cards. Merchant compatibility is uneven: ChatGPT Wallet may not complete checkout at every store, and a failed checkout can leave a pending charge that the user needs to resolve with the merchant and issuer rather than by retrying blindly. The Help Center is explicit that a ready-to-check-out status means approval completed, not that the merchant placed the order, and that users should confirm merchant confirmation before attempting a purchase again. Checkout sessions can also expire or stall, and the guidance there is the same: check the merchant's receipt or order status first, contact the merchant rather than repeating the purchase, and bring in OpenAI Support only if the approval flow itself is stuck.

Fraud guidance rounds out the limits, and it is refreshingly direct. Before approving, make sure you recognize the purchase and trust the seller, and decline otherwise. Report unrecognized card charges to the issuer promptly using the official app or the number on the card. If someone may have accessed the OpenAI account, secure it and report the activity. And never share full card numbers, security codes, passwords, or bank verification codes in a support message, a rule the Help Center repeats in three different sections because social engineering is the attack that tokenization cannot stop.

Delegation does not exist yet in consumer form. The parameters model, spending limits by category and time period, is described as a future direction, which means every purchase today requires the user to be present, reviewing, and biometrically approving. That is the correct default, and it also caps throughput: an agent that must wake the user for every ChatGPT Wallet checkout cannot run long shopping errands unattended. Teams building on the workspace side should also note the scope boundary, since Wallet is absent from Chat, Work, and Codex threads; the iCloud mail and calendar plugins for ChatGPT show how the platform has been expanding connectors around the agent, and payments are deliberately the slowest expanding surface of all.

The competitive read is equally plain. OpenAI is wiring agent commerce into the existing card network rails rather than building an alternative rail, preserving issuer economics and dispute flows at the cost of depending on banks and networks to recognize and route agent traffic. Whether that integration moves fast enough to beat closed-loop alternatives will show up in the decline rates merchants report over the next two quarters. What is already clear is the direction of travel: the company that owns the shopping conversation now owns the checkout moment too, and ChatGPT Wallet is the mechanism that makes that ownership safe enough for the card industry to accept.

Questions readers are asking

Which cards and users can use ChatGPT Wallet at launch? US-based ChatGPT Pro subscribers aged 18 and older with eligible US-issued American Express, Chase, Mastercard, or Visa cards. Chase cards require primary cardholder status, virtual cards are not supported for enrollment, and the bank may require verification during setup. The wallet works only in conversations with a dot, not in Chat, Work, or Codex threads.

Does the merchant or the agent see my actual card number? No. Card details are entered once in a secure form outside chat, and each approved purchase uses a payment token, a substitute credential with its own number, security code, and expiration date generated by the payment network. The number at checkout differs from the physical card number, and the real details are never shared with the business or the agent.

Do I keep my card rewards and dispute protections? Yes. The payment is charged to the card you selected, so existing rewards accumulate as they would on any purchase, and the card's protections for eligible disputes with businesses, such as defective items, apply. You transact directly with the merchant, which keeps control of pricing, fulfillment, returns, and customer service.

What happens if a checkout fails or a pending charge appears? Check for a merchant order confirmation before doing anything else, because approval completing does not guarantee the merchant placed the order. If there is no confirmation, contact the merchant about the order and the card issuer about the pending hold rather than immediately retrying, since a conversation error alone does not tell you the order status or when the hold clears.

Does ChatGPT Wallet work at every store? Not yet. Wallet may not complete checkout at every merchant, especially where bot rules block agent traffic or risk systems reject the token. If a purchase fails, check for a merchant order confirmation before trying another payment method directly with the store, and remember that approval status does not confirm the merchant placed the order.

Can the agent buy things automatically without my approval? Not at launch. Every purchase requires a review of items, total, and card, followed by a biometric approval such as Face ID or Touch ID, creating an authorization record for each transaction. OpenAI describes future delegation with spending limits, purchase categories, and time periods as a direction, but pre-approved unattended purchasing is not part of the initial release.

Sources
[fluentform id="2"]