# Credentials & agents \[The Paybox model] Four concepts cover everything Paybox does. ## Credential Something sensitive you vault once. Three types: | Type | Vaulted via | Agents receive | | --- | --- | --- | | **Card** | Basis Theory tokenization (no raw PAN in Paybox) | a one-time virtual card | | **Wallet** | MoonX MPC (key never leaves the TEE) | a signed transaction | | **Secret** | Envelope-encrypted (KMS) | a short-lived token (or proxied use) | ## Client An **agent integration** — Claude Code, an OpenAI agent, your own MCP server — runs under its own **client key**. One agent, one key. Rotate or revoke a client without touching the underlying credentials. ## Grant A client is given **grants**: which credentials it may use, and under what **approval mode**. Grants are scoped per credential. ## Approval mode Set per grant: * **Human approval** — every operation pauses for your passkey approval. * **Autonomous** — the agent acts without per-op approval, *within the grant*. Regardless of mode, **sensitive operations** (revealing a raw secret, signing, issuing keys) require a fresh passkey assertion, and every operation is an audit event. See **[Approvals & passkeys](/concepts/approvals)**. :::info Scoped outputs, never raw credentials. An agent with a card grant can request a charge; it never sees the card number. A wallet grant yields signatures, never key shares. :::