> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jointransfer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring your own virtual card

> Link a bank-issued virtual card and prepare scoped agent checkout.

Open your authenticated [dashboard](https://jointransfer.com/dashboard). New accounts follow **Agent → Virtual card → Connect**. Choose **Add agent**, enter its name and purpose in the modal, then choose **Create agent**. The same modal continues to linking that agent’s one virtual card. No Transfer wallet top-up is required.

You can choose **Finish later** without entering card details. The agent stays saved, and the dashboard shows its **Awaiting card** tile. Choose **Link card** on that tile to resume its fixed card step, or **Setup guide** to return to the guide. Finishing later is remembered across sign-ins; it does not approve or enable card access.

## Secure setup first

If the manager shows **Secure setup required**, it accepts no card details. Linking requires valid Evervault app credentials and activated card storage. Browser Tokens preview approval is separate: a card can be securely linked while waiting for agent checkout access. A configured integration still needs collection, provider, and merchant verification before it can be relied on for live checkout.

A real bank card requires a production Evervault app with live mode. Sandbox is for provider test cards only. Sandbox and production app keys cannot use each other’s encrypted cards.

When configured, the card number and expiry are collected through [Evervault's hosted Card component](https://docs.evervault.com/sdks/javascript). Transfer saves the encrypted number, expiry, and masked metadata. It does not collect or store CVC, including encrypted CVC.

## Link the agent’s card

1. Use a dedicated card with actual spending limits set at the issuing bank.
2. The card uses the agent’s nickname automatically. Its agent is fixed by the setup you opened; each agent has one card, with no separate card nickname or assignment dropdown.
3. New cards use **All merchants** by default. There is no merchant or payment-hostname field to fill in.
4. Save the card, then generate the agent's private connection key from the Connect step or its dashboard tile. Each agent appears in one tile with its own card, status and connection.

New cards return `allowed_hosts: ["*"]`, which allows all destinations through the checkout proxy. Existing cards with explicit destinations keep their saved restrictions. Spending limits remain with the bank; bank balances and transaction history are not connected.

## Use a compatible checkout browser

`get_payment_card` or the payment-details REST endpoint returns a short-lived number token, expiry, and proxy credentials when Transfer access is enabled, checkout configuration is ready, and Evervault has approved Browser Tokens access. Until checkout is ready, card metadata reports `usable_for_checkout: false` (or `usableForCheckout: false` through REST), and payment access is unavailable even if the card is linked. The browser must route checkout through that proxy and trust the Evervault CA. A standard browser or tool that cannot configure the proxy and CA cannot use this flow. Never treat the number token as ordinary card details outside the proxy.

CVC is `null` and `requires_owner_cvc` is `true`. If required, the owner enters the CVC directly at the merchant. Bank authentication or 3D Secure can also require the owner. Checkout compatibility and successful payment are not guaranteed by token retrieval.

## Disable or remove

**Disable Transfer access** prevents new checkout sessions. Already-issued tokens expire within five minutes. Remove the link or revoke the agent key when access is no longer needed. These actions do not freeze or cancel the card at your bank; use your banking app for that.

Transfer wallets, funding, and Transfer-issued cards are **coming soon**. External card activity does not debit or fund a Transfer wallet.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.