With the race to build agent commerce, there is no lack of attention for artificial intelligence (AI) assistants. OpenAI, Google, Perplexity and others want consumers to rely on software to make shopping decisions.
However, before an AI agent can complete a purchase, merchants, issuers, and payment networks must know that the agent is authorized to act. This requirement makes token service providers one of the most strategically important layers in digital commerce.
Tokenization has been happening behind the scenes for a long time. Consumers give little thought to replacing card numbers with secure credentials, and merchants likely see tokenization primarily as a tool to reduce fraud.
But thanks to proxy commerce, tokens are becoming more than just a replacement for payment credentials. It is becoming a mechanism for establishing identity between parties that do not interact directly with each other.
A recent PYMNTS Intelligence study with Worldpay reveals why this issue matters. While 45% of consumers report being satisfied with the ability of an AI agent to complete a purchase on their behalf, 95% express at least one concern related to agent commerce. The same study found that half of U.S. consumers would trust commercial transactions more if fraud protection was clearly established. These findings suggest that while consumer interest exists, trust in the underlying infrastructure remains unstable.
The new role of token service providers
The way a Token Service Provider (TSP) works is relatively simple. TSPs issue and manage tokenized credentials that replace sensitive payment information. In traditional e-commerce, this process reduces fraud and limits the exposure of underlying card data.
Advertisement: SCROLL TO CONTINUE
Agent Commerce expands the responsibilities that come with that credential.
According to PYMNTS Intelligence’s Prompt Economy study, tokenized credentials allow consumers to authorize AI agents to make purchases within predefined limits while protecting the underlying payment details from merchants. Rather than directly transmitting account information, transactions rely on credentials associated with consumer-established privileges.
This may sound like a technical difference, but it is important. In traditional transactions, the seller knows that the consumer has actively initiated the purchase. In an agent environment, the software may operate based on instructions provided hours, days, or weeks in advance. Therefore, merchants need a way to determine not only whether payment credentials are valid, but also whether the software itself is operating with legitimate authority.
TSP becomes the connective tissue that ties those decisions together.
Although Visa and Mastercard are working on agent commerce through various programs and partnerships, both have established trusted frameworks for autonomous transactions.
Visa’s recent announcements include new token features designed to enhance agent scores, agent directories, and transaction data and provide assurance signals on agent purchases. The company also announced a partnership aimed at incorporating Visa credentials into emerging agent commerce environments.
What they have in common is validation. Visa is attempting to create a mechanism that allows merchants and issuers to assess whether a transaction is coming from an authorized participant in the agency commerce ecosystem.
Mastercard’s strategy follows a similar logic. PYMNTS recently reported on Mastercard’s partnership with Wizard and Stripe. There, Mastercard Agent Pay and tokenized payment credentials are integrated into an AI-driven shopping environment. This environment connects product discovery and transaction execution within a framework that provides visibility into who is acting and under what authority.
Neither company is trying to own every AI assistant. Both seek to position themselves as trusted intermediaries between consumers, sellers, and autonomous software.
Transaction control
Consumers may be attracted to AI assistants that provide the best recommendations. Seller may support multiple agent platforms. Large-scale language models continue to evolve. The authentication layer underneath these experiences may prove to be more durable.
All autonomous transactions require identity verification. All identities require credentials. All credentials require a framework to establish trust.
As such, there is an increased focus on token service providers as they move deeper into the payments stack where networks, issuers, and token providers decide whether autonomous software can transact in the first place. Companies that control the interaction layer are also in a position to facilitate proxy commerce and control how it operates.
