Skip to main content
Embedded Payment Widgets

Embedded payment widgets, PCI-compliant card capture

Run your Nevermined organization and drop a PCI-compliant iframe into your app so customers add a card and check out inline. Your org issues the widget keys; the raw card number never touches your servers.

Get widget keysRead the docs
Audit-ready
ISO 27001SOC 2 Type IIPCI SAQ-D
Drop-in iframe

One snippet. Card capture inside your own checkout.

Mount the widget where you collect payment. Your customer enters their card inline, it is tokenized inside a Nevermined-served iframe, and you get a payment method back, never a raw card number.

  • Renders right inside your checkout
  • Zero PCI scope: card data never touches your servers
  • Tokenized by VGS, verified with 3DS or a passkey
// 3 lines to embed
const nvm = await NeverminedWidgets.initialize({ session })
nvm.delegations.enrollCard({ container: el, onSuccess })
acme.store/checkout
Complete your purchase
Add a card to finish checking out.
Nevermined iframe
VISA
•••• •••• •••• 4242
Acme Agent Inc12 / 28
4242 4242 4242 4242
VISA
12 / 28
•••
Encrypted by VGS. Nevermined never sees your card number.

Three flows, one integration

Mount what your product needs, where it needs it.

1

Card capture

Customers add a real card inline. Tokenized by VGS, verified with 3DS or a passkey.

2

Checkout

Take payment for a plan or a one-off inline, with the same session and iframe security model.

3

Saved cards

Let customers view and manage the cards on file, without you handling card data.

Zero PCI scope

Your server is never in the card-data path

The card number only ever exists inside the Nevermined iframe and the VGS vault. Your code receives a token, never a PAN.

Your app
Mounts the iframe where you collect payment.
Nevermined iframe + VGS
Captures the card and tokenizes it inside the vault.
Card rail
Charges via Stripe and Braintree today; Visa soon.
  • The raw PAN lives only in the iframe and VGS, never your servers
  • You stay at PCI SAQ-A scope: no card data to store or audit
  • Your handler gets a token back: save it, charge it later, done
// mount the widget, get a token back
const nvm = await NeverminedWidgets.initialize({ session })
nvm.delegations.enrollCard({
container: el,
onSuccess: ({ result }) => {
// a token, never a card number
save(result.paymentMethodId)
},
})

Widget keys are issued by your organization - the merchant account that also runs your plans, customers, and payouts.

Organizations, explained →

How it works

From organization to a live, embedded checkout.

Step 1

Create your org

Spin up an organization account, publish plans, and invite your team.

Step 2

Generate a widget key

Create an organization widget key and set the origin allowlist.

Step 3

Mint a session

Your backend exchanges the key secret for a short-lived session, server to server.

Step 4

Mount the widget

Initialize the browser SDK with the session and mount capture or checkout into any container.

Where it fits

Part of the way you sell to and get paid by agents.

Accept Agent Payments

The overview of every way to sell to agents.

API Providers

Let buyers enroll a card on your domain, then sell your API.

Pay Widgets

The same widgets, framed for funding agents to spend.

Frequently asked questions

Organizations and embedded payment widgets.

An organization is your merchant account. It holds your plans, agents, customers, and payouts in one place, with multi-seat team access, and it issues the widget keys you use to embed card capture and checkout. You publish what you sell, agents and customers pay for it, and the revenue settles to your org.

Organization + widgets

Run your org, embed the payments

Create an organization, generate a widget key, and embed card capture into your checkout.

Create an organizationRead the docs
Zero PCI scopeOrg-scoped widget keysStripe live, Visa soon