Skip to main content

Your API, agent-payable

Live with Exa. Get paid by AI agents.

How?
Embedded Payment Widgets · Organizations

Take card payments inside your product

Run your Nevermined organization and drop a PCI-compliant iframe into your app so customers add a card and check out inline. Your org issues the widget keys; the raw card number never touches your servers.

Audit-ready
ISO 27001
SOC 2 Type II
PCI SAQ-D
Drop-in iframe

One snippet. Card capture inside your own checkout.

Mount the widget where you collect payment. Your customer enters their card inline, it is tokenized inside a Nevermined-served iframe, and you get a payment method back, never a raw card number.

  • Renders right inside your checkout
  • Zero PCI scope: card data never touches your servers
  • Tokenized by VGS, verified with 3DS or a passkey
// 3 lines to embed
const nvm = await NeverminedWidgets.initialize({ session })
nvm.delegations.enrollCard({ container: el, onSuccess })
acme.store/checkout
Complete your purchase
Add a card to finish checking out.
Nevermined iframe
VISA
•••• •••• •••• 4242
Acme Agent Inc12 / 28
4242 4242 4242 4242
VISA
12 / 28
•••
Encrypted by VGS. Nevermined never sees your card number.

Three flows, one integration

Mount what your product needs, where it needs it.

1

Card capture

Customers add a real card inline. Tokenized by VGS, verified with 3DS or a passkey.

2

Checkout

Take payment for a plan or a one-off inline, with the same session and iframe security model.

3

Saved cards

Let customers view and manage the cards on file, without you handling card data.

Zero PCI scope

Your server is never in the card-data path

The card number only ever exists inside the Nevermined iframe and the VGS vault. Your code receives a token, never a PAN.

Your app
Mounts the iframe where you collect payment.
Nevermined iframe + VGS
Captures the card and tokenizes it inside the vault.
Card rail
Charges via Stripe today; Visa and Braintree soon.
  • The raw PAN lives only in the iframe and VGS, never your servers
  • You stay at PCI SAQ-A scope: no card data to store or audit
  • Your handler gets a token back: save it, charge it later, done
// mount the widget, get a token back
const nvm = await NeverminedWidgets.initialize({ session })
nvm.delegations.enrollCard({
container: el,
onSuccess: ({ result }) => {
// a token, never a card number
save(result.paymentMethodId)
},
})

The organization behind the widgets

A widget key is issued by your org. Here is the rest of what the org runs.

1

Identity & access

Scoped widget keys with origin allowlists, role-based team seats, and every enrollment verified by 3DS or a FIDO2 passkey. You decide which domains, and which people, can transact.

2

Money movement

Settlement, Stripe Connect payouts, disputes, and refunds run through one billing surface, so reconciliation is a single ledger instead of five.

3

Visibility & control

A live customer list, webhook events, and revenue plus usage analytics broken down per plan, per agent, and per customer, with audit-ready logs.

How it works

From organization to a live, embedded checkout.

Step 1

Create your org

Spin up an organization account, publish plans, and invite your team.

Step 2

Generate a widget key

Create an organization widget key and set the origin allowlist.

Step 3

Mint a session

Your backend exchanges the key secret for a short-lived session, server to server.

Step 4

Mount the widget

Initialize the browser SDK with the session and mount capture or checkout into any container.

Organization tiers

Start on a personal account, upgrade when you are ready to scale.

Recommended

Premium Org

Embedded payment widgets, auto-generated agent docs, customer list, webhooks, analytics, and multi-seat access. Everything to sell to agents out of the box.

Create an organization

Enterprise Org

Premium plus unlimited agents and plans, plus pilot, whitelist, and fee-waiver programmes for qualifying teams.

Talk to us

Frequently asked questions

Organizations and embedded payment widgets.

An organization is your merchant account. It holds your plans, agents, customers, and payouts in one place, with multi-seat team access, and it issues the widget keys you use to embed card capture and checkout. You publish what you sell, agents and customers pay for it, and the revenue settles to your org.

Organization + widgets

Run your org, embed the payments

Create an organization, generate a widget key, and embed card capture into your checkout.

Zero PCI scopeOrg-scoped widget keysStripe live, Visa soon