Card-issuing capabilities

All 16 primary features of our Visa issuing partner's card-issuing product, how to use them through Soren Pay, and sandbox tricks for testing.

1. Real-time authorization (sub-200ms)

Every swipe hits /api/webhooks/reap-authorization. Our evaluateAndSettle() runs the full policy check (state, limits, MCC, merchant, balance) in a single Postgres CTE with pg_advisory_xact_lock per card — sub-200ms p99.

See the live demo at sorenpay.com (Authorization engine section).

2. Real-time settlement

Settlement is real-time too — no T+1 holds. The moment the issuing partner confirms the swipe, your workspace ledger reflects the debit. The card_settlement ledger source distinguishes it from card_authorization_hold (used for variable-amount auths like fuel pumps).

3. Multi-currency card denomination

Cards can be denominated in USD, HKD, EUR, GBP, SGD. Pass denomination on mint (live mode only — sandbox defaults to USD).

curl -X POST https://api.sorenpay.com/api/cards \
-H "Authorization: Bearer apk_…" \
-d '{
  "holderKind": "agent",
  "holderLabel": "hk-ops-agent",
  "denomination": "HKD",
  "monthlyLimitUsdCents": 100000,
  "perTxnLimitUsdCents": 10000
}'

4. Apple Pay + Google Pay

In-App Provisioning works on every issued card. Provisioning is client-side (PassKit / Google Wallet SDK); we pass the encrypted card data through after a card-on-file token request.

5. Stablecoin-funded cards

Cards swipe directly from a USDC or USDT balance. Soren Pay's auth engine already sums column_fiat + reap_stablecoin balances in the decision CTE, so no special opt-in.

6. MCC + merchant + velocity + geo scope

The bread and butter. Combine to your taste:

curl -X POST https://api.sorenpay.com/api/cards \
-H "Authorization: Bearer apk_…" \
-d '{
  "holderKind": "agent",
  "holderLabel": "research-bot",
  "allowedMccs": ["5734", "7372"],
  "allowedMerchants": ["openai", "anthropic", "pinecone"],
  "monthlyLimitUsdCents": 500000,
  "perTxnLimitUsdCents": 50000
}'

7. Agentic Payments (Visa Intelligent Commerce)

Cards minted with holderKind: "agent" can be bound to Ed25519-signed intents via the Agents API. The signed intent flows through Visa's Intelligent Commerce network for an extra cryptographic attestation layer at swipe time.

8. Branded card artwork

Six visual templates today (obsidian, aurora, cyber, magenta, chrome, gold). Custom artwork (logo, brand color) is supported via our issuing partner's design tool in live mode — pass artwork_id on mint.

9. Card lifecycle (freeze / unfreeze / terminate / reissue)

curl -X PATCH https://api.sorenpay.com/api/cards/<id> \
-H "Authorization: Bearer apk_…" \
-d '{"state": "frozen"}'

Termination is irreversible.

10. Real-time webhooks

Subscribe to:

| Event | When | |---|---| | card.minted | After successful mint | | card.frozen / card.terminated | State changes | | card.shipped / card.delivered | Physical card lifecycle | | card.authorization.approved / .declined | Every swipe | | card.settlement | Settlement confirmed | | card.dispute.opened | Cardholder disputes a charge |

11. PCI-DSS compliance

Our issuing partner holds the PCI scope. PAN reveal happens via a secure iframe — your servers (and ours) never touch raw card numbers.

12. 3D Secure

Auto-enabled for card-not-present transactions in live mode. Reduces chargebacks, shifts liability appropriately.

13. Disputes + chargebacks

Visa-native dispute flow handled by our issuing partner. We surface dispute state in the dashboard; you provide evidence (receipt, communication log) via the POST /api/cards/[id]/disputes/[id]/evidence endpoint. See Disputes use-case.

14. Global Visa acceptance

Accepted at 100M+ merchants worldwide. Same card works for SaaS subscriptions, travel, agent purchases, in-person retail.

15. Card-on-file tokenization

Agents can store cards-on-file with merchants for recurring AI workloads (OpenAI Pay-as-you-go, Anthropic, Pinecone, AWS, etc.). The merchant gets a network token, not a raw PAN — tokens are scoped to that merchant and revocable.

16. Virtual + physical

Already covered above. Worth repeating: virtual mints instantly; physical ships in 5-7 business days via Idemia or Thales (our issuing partner manages the partner relationship).

Sandbox testing tricks

| What | How | |---|---| | Trigger manual_review on KYB | Set business_name = "Review" | | Trigger denied on KYB | Set business_name = "Denied" | | Skip KYB entirely | Workspace mode = "sandbox" bypasses the KYB gate | | Simulate a swipe | POST to /api/webhooks/reap-authorization (sandbox skips HMAC) |

← All docs Edit on GitHub →