Accounts & Agents - Prava Payments Docs

Prava doesn’t have a standalone “wallet” object. What it has is an account owned by a person or business (the agent owner), managed from the Prava Pay dashboard. The account holds the enrolled cards and saved addresses, and the owner authorizes one or more AI agents to pay on their behalf.

Two portals, two audiences. dashboard.prava.space is the developer console: sign up, create API keys, manage allowed domains, switch to production. pay.prava.space is the Prava Pay dashboard for agent owners: approve agent links, enroll cards, set spending controls. A developer integrating the API only needs the console; an agent owner only needs the Prava Pay dashboard.

With Prava, the agent never holds funds or a raw card. It acts against the owner’s account under the owner’s controls, and only ever receives one-time, scoped credentials at the moment of purchase.

The model

Agent owner: a dashboard user who owns the account and manages everything at pay.prava.space.
Cards & addresses: enrolled once and held on the owner’s account.
Agents: the owner links and approves each agent; every agent gets its own secure identity.
Shared access: all of an owner’s agents draw on the same cards. There are no per-agent card permissions.

Authorizing agents

An agent is connected through the linking flow: it requests access, and the owner approves it in the browser. From then on an agent is either active or revoked. It’s all-or-nothing, not a permissions matrix. Revoking an agent cuts off its access immediately.

Spending controls

These are the controls that actually exist and are enforced:

Control	What it does	Where it’s enforced
Checkout quota	A set number of checkouts allowed per owner (a lifetime count), consumed as agents buy.	Prava (application level)
Concurrency limit	Caps how many checkouts can be open at once (a small number).	Prava (application level)
Per-purchase approval	Every spend requires explicit approval before it happens. The Skills enforce a hard stop for agents; SDK/hosted flows use passkey confirmation (a biometric or security-key approval on the user’s device).	Owner / device
Per-merchant amount limits	When a card is enrolled for agentic commerce, each authorization is locked to the merchant and amount.	Card network (Visa)

Quota and concurrency are Prava application-level limits. Merchant/amount locking is enforced by the card network. See Guardrails for the network-level detail.

Cards on the account

Cards are enrolled through Prava’s secure collection (collectPAN or a hosted page) and tokenized: the number is replaced with a secure stand-in, and the raw card never touches the app or the agent. Each card carries:

a status (active / deleted),
an agentic-commerce flag (isAgenticCommerceEnrolled) indicating it’s enabled for AI-initiated purchases,

and is visible from the dashboard and the List Cards API.

Link an agent

How an owner approves an agent against their account.

Guardrails

The network-level constraints on what an authorized purchase can do.

​The model

​Authorizing agents

​Spending controls

​Cards on the account

​Related

Link an agent

Guardrails

The model

Authorizing agents

Spending controls

Cards on the account

Related