SPTs answer the scariest question in agentic commerce — "does the agent hold my card?" — with no. The buyer's payment method stays vaulted; the agent platform passes a token that can only be used within the agreed scope, and the merchant charges it like a normal payment.
Stripe introduced SPTs alongside the Agentic Commerce Protocol and later broadened agentic checkout beyond cards to additional payment methods. It's the card-rail sibling of crypto-native approaches like x402, and one of several delegated-credential schemes (Visa's Intelligent Commerce and Mastercard's Agent Pay tokens play similar roles on their networks).
No. The card stays vaulted with the payment provider; the agent only carries a scoped token that authorizes a specific kind of charge, so a compromised agent can't reuse or exfiltrate your credentials.