Clearpayo — free card tokenization built for AI agents

Built for AI agents

Agents shouldn't need a compliance team.

Coding agents are great at checkouts and terrible at handling card data safely. Clearpayo gives them one small, deterministic surface to get right.

✓One prompt, one passPaste the prompt into Claude, Codex or Cursor. It swaps the card inputs and the pay call, nothing else.
✓Machine-readable docs/llms.txt gives agents the whole SDK, error codes and rules in one plain-text file.
✓No keys in the browser, no dashboardStores on SpecialX are already connected. Nothing to sign up for, nothing to leak.
✓Errors an agent can branch oninvalid_number, invalid_exp, invalid_cvc, network. The fields show their own messages.
✓Safe by constructionEven a buggy page can't read the inputs: they live on another origin.

Prompt for your agent

Add Clearpayo card fields to this store's checkout.
1. Load https://vault.clearpayo.com/sdk.js once on the checkout page.
2. Mount the fields where the card inputs are: ClearpayoFields.mount(el, { layout: "inline", style: { ...match the page's font, border, focus and radius... } }).
3. Remove the old card number / expiry / CVC inputs and any client-side card encryption.
4. On pay: const { token } = await fields.tokenize(); then POST /api/checkout/charge with vault_token: token (everything else unchanged).
5. Show your own error only when err.code === "network"; invalid_* errors are shown inside the fields.
6. If the page has a CSP, allow script-src and frame-src https://vault.clearpayo.com.
Docs: https://checkout.specialx.ai/docs#card-tokenization-with-clearpayo
Full agent guide: https://clearpayo.com/llms.txt

How it works

Fields in. Token out. Charge as usual.

The card goes from the buyer's keyboard straight into the vault. Your store only handles a token the vault will release to your store alone.

Mount the fields

One script, one element. Match your fonts, borders, radius and colours.

<script src="https://vault.clearpayo.com/sdk.js"></script>

Tokenize on pay

The iframe validates and encrypts the card, then hands back a token.

const { token } = await fields.tokenize()

Charge with the token

Send it to your checkout. The platform claims it and charges your provider.

POST /api/checkout/charge { vault_token: token }

checkout.htmlThat's the whole integration

<script src="https://vault.clearpayo.com/sdk.js"></script>
<div id="card"></div>
<script>
  const fields = ClearpayoFields.mount('#card', { layout: 'inline', style: { borderRadius: '8px', focusColor: '#3f5d42' } });
  payButton.onclick = async () => {
    const { token } = await fields.tokenize();             // tok_… — never the card number
    await fetch('/api/checkout/charge', { method: 'POST', body: JSON.stringify({ vault_token: token, ...order }) });
  };
</script>

Security

A vault that's separate in every way.

Card data lives in its own service, its own database and under its own keys, apart from the stores and the platform that use it.

⛨

Isolated iframe

Inputs are rendered on vault.clearpayo.com. The store page, its scripts and its extensions can't read them.

⚿

AES-256-GCM, per row

Each card number and CVC is encrypted and bound to its own token and column, under versioned keys that rotate without downtime.

⌖

Origin-bound tokens

A token only works for the store whose page it was typed on. Copy it to another store and the vault refuses it.

⌛

CVC never kept

Deleted after the first authorization, and in any case within an hour. Abandoned tokens are gone within a day.

≡

Every access logged

Tokenize, claim, decrypt, purge and delete are all recorded, including refused attempts.

⌁

No public read API

Card data can only be read back over a private service connection, never over the internet.

Pricing

$0 / forever

No monthly fee, no per-token fee, no API-call metering. You only pay your payment provider, as before.

✓Hosted card fields
✓Unlimited tokens
✓Inline & stacked layouts
✓Your fonts and colours
✓Visa, Mastercard, Amex, Discover, JCB, Diners
✓3-D Secure via your provider
✓Subscriptions & saved cards
✓Access audit log

FAQ

Questions, answered.

Is it really free?

Yes. Clearpayo has no monthly fee and no per-token or per-call fee. Your payment provider still charges its normal processing fees.

Who can use it today?

Every store running on SpecialX, on its specialx.ai subdomain or its own custom domain. Standalone access for other platforms isn't open yet.

Which payment providers work?

Whichever provider your SpecialX store already uses for cards. The platform reads the card from the vault over a private connection and passes it to that provider, so switching providers doesn't mean asking customers for their card again.

Do I still need PCI compliance?

Card numbers never reach your pages or servers, which keeps them out of most of your PCI scope. Your acquirer decides which self-assessment questionnaire applies to you. Clearpayo's own compliance documentation is in preparation; contact us if your acquirer needs it.

Can my agent really do this alone?

That's the point. The prompt above, plus /llms.txt, contains everything needed: where to load the script, how to style it, what to send on pay and how to handle each error.

Can I make it look like my checkout?

Yes: font (including Google Fonts), size, colours, borders, focus and error colours, radius, height, inline or stacked layout, labels, placeholders and error messages. It's all styling, so no code of yours runs inside the vault.

Card tokenization your AI agent sets up in one prompt.