What is a single-use virtual card?
A single-use virtual card is a card number issued for one purchase, with a limit set to the approved amount. After the charge it can't be used again, so it can't be reused by the supplier or by someone who finds the number.
Example
A request for a $1,150 monitor is approved. A card is issued with a $1,150 limit. The store charges $1,150 and the card closes. If the store tries a second charge of $40 the next day, it's declined.
Compare a shared company card: the number sits in five browsers and three subscriptions, and one leak affects all of them.
In Atta
With a card issuer configured and the workspace's card program on, placeOrder issues one card per order, capped at the reserved total on the issuer's side too. The authorization check has zero tolerance: a charge above the approved amount is declined.
The number and CVC never enter Atta. The person sees them in Stripe's own frame. For a card order, the issuer's events are the only thing that moves the budget; the store's webhook moves the order status.
Cancelling an order cancels the card before the reservation is released, and if the card can't be cancelled the hold stays. A workspace runs on its own connected account, and losing the account stops issuing without touching existing holds.
Limits worth setting
Besides the amount, a card can be limited by merchant category and by expiry. In Atta the program names the allowed categories, and an unused card is cancelled after the 24 hour abandon window, so a forgotten subscription has nothing to renew on.
Questions
Does the agent see the card number?
No. The number and CVC are shown to the person inside Stripe's frame and never pass through the app.
Related
- What is a budget reservation?A budget reservation holds money for an order before it is paid. Committed means held, spent means paid. Definition and a worked example.
- Virtual cards for purchases an AI agent makesAtta issues one single-use Stripe Issuing card per approved order, capped at the approved total and checked on every charge. The number never enters the app.