You set the limits
Caps by amount, merchant, and expiry, plus velocity and per-payment approval. Your agent can only pay within the rules you set.
For you and your agent
Connect a card once with a real bank check. Set limits and rules. Your agent pays within them, every payment is provable and reversible, and you see all of it.
Caps by amount, merchant, and expiry, plus velocity and per-payment approval. Your agent can only pay within the rules you set.
Every payment is recorded with a cryptographic proof, shows up in your audit log, and is disputable and reversible.
Pull an agent's access from the wallet and outstanding mandates are invalidated at once. You stay in control.
Straight answers
No. Mandates are cryptographically capped by amount, merchant, and expiry. An over-cap or wrong-merchant request is rejected at verification.
You register it once via Stripe with a real bank check (3DS/SCA). OID4Pay never stores raw card data and money settles to your own bank. Not stored value.
Revoke from the wallet; the server cascade-revokes the agent's tokens and invalidates outstanding mandates. Every payment is auditable and disputable.
Mandates are per-merchant and OID4Pay does no cross-merchant aggregation. (Per-merchant cryptographic unlinkability is on the roadmap.)