Agentcard vs Sponge Wallet

Agentcard

Purchases need the user's passkey approval by default, cards carry spending rules, and card creation takes an idempotency key. No status page, published rate limits beyond the token endpoint, or privacy policy of Agentcard's own was found, and the Trust Centre could not be read. Issuing costs $5,000 a month.

Sponge Wallet

An agent can register a wallet with one unauthenticated call and pay x402 or MPP endpoints under daily, weekly and monthly limits enforced on Sponge's servers. No status page, rate limits, fee schedule, custody statement or security contact was found, the terms run to eleven short clauses, and the SDK was last published on 7 July 2026.

Agentcard

1. Mint a platform token with POST /api/v2/oauth/token and cache it for its one hour. The endpoint allows 30 requests per 5 minutes per IP
2. Send the same Idempotency-Key on every retry of POST /api/v2/cards, and the same idempotency_key on every retry of buy_checkout
3. Pass source: "issued" to the MCP create_card tool for a card number. Without it the tool may start Vault setup and return a link
4. Call get_card_details only at the payment form and never log the result. Each read notifies the member and may return approval_required
5. Treat transaction.authorized and order.* webhooks as the record of a payment, and deduplicate deliveries on the event id

Sponge Wallet

1. Send Sponge-Version on every REST request. The skill file marks it required and the API answers with version status headers
2. Use evmTransfer and solanaTransfer, the helpers the docs describe as enforcing allowlists and spending limits, not plain transfer
3. Store the apiKey from registration at once. It is returned a single time, and losing it means registering again
4. Call GET /api/discover/{serviceId} before POST /api/paid/fetch. The skill file says direct service URLs fail with auth errors
5. Treat card details output as secret. It returns an encrypted card number and CVC with a one-time secret_key