Card Provider Authentication

Visa and Mastercard agentic commerce protocol authentication within Layout

Manage Payment Method

Card Provider Authentication

Visa and Mastercard agentic commerce protocol authentication within Layout

Manage Payment Method

Why your card provider asks before Layout can order

Layout places real orders at real restaurants on your behalf. That is a new kind of payment, and the card networks treat it as one. Visa and Mastercard both built a framework for it. Both start from the same rule. Before anything can order for you, the network has to confirm two things. That you are the cardholder, and that you meant to allow it.

So adding a card to Layout happens in two parts. The first part is saving the card, which takes a few seconds. The second part is your card provider verifying you, which is the step you may have just seen. Your bank sends you a one time code. You confirm it is you on your own device. Your device then creates a passkey, which is a credential stored on your phone and protected by Face ID, Touch ID, or your screen lock. That passkey is what your card network checks from then on.

You only do this once per card. After it is done, Layout can order for you without asking you to repeat it.

A card that skips this step still appears in your Layout wallet, but it cannot pay. Orders using it will be declined by the network. This is why Layout asks you to finish the step rather than letting you move on.

Layout places real orders at real restaurants on your behalf. That is a new kind of payment, and the card networks treat it as one. Visa and Mastercard both built a framework for it. Both start from the same rule. Before anything can order for you, the network has to confirm two things. That you are the cardholder, and that you meant to allow it.

You only do this once per card. After it is done, Layout can order for you without asking you to repeat it.

What Layout can and cannot do with your card

Layout never sees your full card number. When you type it in, the number goes straight to our payment vault provider and is replaced with a reference. Our systems hold that reference, your card brand, and the last four digits. Nothing else.

When you place an order, Layout does not use your real card number at the restaurant. Your card network issues a separate, single use card number for that one order. It carries a spending limit, and it is tied to that purchase. It cannot be reused, and it is not valid anywhere else.

This is the part worth understanding, because it is what makes the whole thing safe. The restaurant never receives your real card details. If a single use number were ever exposed, it would already be spent and limited to one amount.

You approve the amount before anything is charged. Layout shows you the cart and the total first. For larger orders, you confirm with a code. Your card network may also ask you to approve the purchase with the passkey you created, which is the same Face ID or Touch ID prompt you are used to.

Layout never sees your full card number. When you type it in, the number goes straight to our payment vault provider and is replaced with a reference. Our systems hold that reference, your card brand, and the last four digits. Nothing else.

When you place an order, Layout does not use your real card number at the restaurant. Your card network issues a separate, single use card number for that one order. It carries a spending limit, and it is tied to that purchase. It cannot be reused, and it is not valid anywhere else.

This is the part worth understanding, because it is what makes the whole thing safe. The restaurant never receives your real card details. If a single use number were ever exposed, it would already be spent and limited to one amount.

You approve the amount before anything is charged. Layout shows you the cart and the total first. For larger orders, you confirm with a code. Your card network may also ask you to approve the purchase with the passkey you created, which is the same Face ID or Touch ID prompt you are used to.

Delegated Spending Authority

How to manage or remove this authorization

You stay in control of this, and there are three places you can act.

In Layout. Open your wallet and remove the card. This is the most complete option. Removing a card in Layout deletes the stored reference, removes the copy held by our billing provider, and ends the authorization with your card network. Layout can no longer order with that card.

With your bank. Your issuing bank is the primary place to manage agent authorizations for both Visa and Mastercard. Look in your banking app for agent permissions, connected services, or passkeys. Your bank can revoke the authorization directly, and it can do so without cancelling or reissuing your card.

With Visa. If you use Visa, you can review and manage your Visa profile and saved cards at src.visa.com/account. Passkey enrollment and removal for Visa cards is generally handled inside your bank's own app or website, so start there if you do not find what you need. For Mastercard, management is handled through your issuing bank rather than a separate consumer portal.

Two things are worth knowing. Your passkey is tied to the device you created it on. If you verify a card on one phone and then order from a different device, your card network may ask you to verify again. And revoking an authorization only stops future orders. It does not affect an order already placed.