A new card for every agent.
Per-agent virtual Visa cards, scoped to a merchant, an amount, a window. The PAN never reaches the model. The card revokes itself when the job is done.
ACTIVEFrom request to revoke in five states.
Every Ovra card moves through the same lifecycle. Each state is observable, auditable, and reversible — except the last one.
PENDINGAgent asks for a card via API or MCP. Intent is captured before any credential exists.
ACTIVEDPAN minted. PAN encrypted at rest with AES-256-GCM. Card is alive, but locked open.
SCOPEDPolicy attaches: merchant lock, amount cap, TTL, MCC. Enforced at the network, not in your code.
AUTHORIZEDNetwork token presented to checkout. Single-use cryptogram. Authorization in milliseconds.
REVOKEDTTL expires or job completes. Card is terminated, audit log sealed. Zero residual exposure.
The agent never sees the number.
Real card credentials are tokenized into a Visa Network Token (DPAN) at issuance. The funding PAN stays inside Ovra, encrypted at rest with AES-256-GCM. Agents transact against the DPAN and a single-use cryptogram — not against your card.
- DPAN, not PAN, in every checkout payload
- PAN/CVV reveal capped at 3 r/s, audit-logged
- Cryptogram is single-use — replay = decline
- Encryption keys rotate; ciphertext is portable
Enforced at the rails. Not your code.
Every guardrail is checked by the issuer before authorization clears. If your application crashes, the card still won't overspend.
Amount caps
Per-transaction, daily, and lifetime ceilings enforced before authorization clears the network.
Merchant lock
Bind a card to a single merchant ID. Anything else is declined at the rails — not by your code.
MCC restrictions
Allow- or block-list Merchant Category Codes. Categorical guardrails: SaaS yes, gambling no.
Country rules
Lock cards to ISO country codes. Cross-border attempts get blocked before the issuer responds.
Time windows
Cards only authorize inside defined TTLs. After the window closes, every charge is rejected.
Velocity caps
Cap charges per minute, hour, or day. Stops a runaway agent from hammering the same vendor.
Issue a card to your first agent.
Get sandbox access in the private beta.