Agentcard vs Privy Wallets (server wallets, agent wallets, policy engine)

Agentcard

Purchases need the user's passkey approval by default, cards carry spending rules, and card creation takes an idempotency key. No status page, published rate limits beyond the token endpoint, or privacy policy of Agentcard's own was found, and the Trust Centre could not be read. Issuing costs $5,000 a month.

Privy Wallets (server wallets, agent wallets, policy engine)

Default-deny policies with DENY precedence on recipients, values, contracts, calldata, typed data and time windows, enforced in AWS Nitro Enclaves. Database problems took API endpoints down for 71 minutes on 18 September 2026, one of 13 incidents since July.

Agentcard

1. Mint a platform token with POST /api/v2/oauth/token and cache it for its one hour. The endpoint allows 30 requests per 5 minutes per IP
2. Send the same Idempotency-Key on every retry of POST /api/v2/cards, and the same idempotency_key on every retry of buy_checkout
3. Pass source: "issued" to the MCP create_card tool for a card number. Without it the tool may start Vault setup and return a link
4. Call get_card_details only at the payment form and never log the result. Each read notifies the member and may return approval_required
5. Treat transaction.authorized and order.* webhooks as the record of a payment, and deduplicate deliveries on the event id

Privy Wallets (server wallets, agent wallets, policy engine)

1. Add a rule for every RPC method the agent needs; a wallet with a policy denies anything unlisted
2. Pair a rolling cap with a lower per-transaction cap, since aggregations update only after signing
3. Send an idempotency key on /rpc, /transfer and /wallets calls; reusing one with a changed body returns 400
4. Set maxValue on the x402 or MPP client for every request
5. Retry a transaction_broadcast_failure; don't retry a policy_violation