Production readiness

Visa Intelligent Commerce uses the same three-environment progression described in Environment Hosts and URL Structure. You must complete each stage before advancing to the next.

Agent Providers are responsible for these obligations as a condition of participating in Visa Intelligent Commerce:

• Consumer disclosures and consent: Provide consumers applicable disclosures and obtain appropriate consents to act on their behalf, including for account creation, login, adding a payment card, confirming a payment, finalizing a sale, and setting up any autonomous/standing purchase instruction.
• Authenticated payment instructions: Submit a payment instruction only after the consumer has accepted required terms and been authenticated for that instruction.
• Transaction validation before requesting a credential: Confirm each proposed purchase transaction matches the consumer's instructions before requesting a token or payment credential. Unless Visa approves an exception, the consumer must review the transaction details and explicitly approve release of the token to the merchant. Agents may not facilitate purchases in restricted merchant categories (see Restricted Merchant Categories, under Core Operations) or purchases requiring age/identity/location verification unless Visa has specifically approved the solution for that use case.
• Compliance, fraud, and safety controls: Comply with applicable laws and Visa Rules; maintain active controls to prevent fraud, money laundering, sanctions violations, and other illegal activity; maintain and enforce an industry-standard acceptable use policy or code of conduct.
• Recordkeeping: Retain transaction records that law or Visa Rules require. Visa is not responsible for retaining or providing these records on an Agent Provider's behalf.
• Cooperation with oversight: Provide requested risk, security, data-handling, and consumer-experience information to Visa, issuers, merchants, or regulators, and cooperate with reviews.
• Dispute resolution (Compelling Evidence 3.0, CE3.0): Send CE3.0 data elements to support auto-resolution of fraud disputes where CE3.0 requirements are met. Visa's CE3.0 program has been expanded to include agentic transactions.
• Card selection; consumer choice protected: Apply the card selection and non-discriminatory rules of the Visa Digital Enablement Program (VDEP). Do not treat Visa or participating issuer cards less favorably than any other cards or networks, and do not steer consumers from their chosen card. Solutions may support the ability to set card preferences or highlight genuine differentiation in card features.

Before you can access the production environment, your integration must pass CTE validation. Complete these items:

Standard Visa Developer certification items:

• Your application correctly implements all required authentication methods.
• All required request fields are populated with valid values.
• Your application handles all documented error codes and retries appropriately.
• End-to-end workflow testing is complete in the sandbox environment.

Product-specific certification items:

• You have completed onboarding to Visa Intelligent Commerce and become an approved ecosystem participant.
• You have onboarded to the Trusted Agent Protocol (TAP), Visa Token Service (VTS), and Visa Payment Passkeys (VPP) as applicable to your integration.
• You have completed registration through the Visa Agent Registry Service (VARS).
• Successful 200 response logs captured for end-to-end flow.
• PCI attestation completed.
• Token Life Cycle Management (TLCM) notification support confirmed.
• Contracts signed.

After passing CTE certification, follow these steps to promote your integration to production.

Standard Visa Developer production promotion:

For the standard environment promotion process, see the Visa Developer Quick Start Guide.

Product-specific eligibility steps:

Complete Visa enrollment, governance, and operational requirements established for agentic commerce participants. Agent Providers operating in production must meet these requirements in addition to standard Visa Developer promotion.

Performance and rate limits:

Specific numeric rate limits and token TTL values are not stated in the spec or questionnaire. Confirm with the product/API team.

Client design in production:

Authentication state is time-bound throughout the transaction lifecycle: consumer authentication sessions expire and must be refreshed, and purchase instructions expire per their default or mandate-defined validity window; tokens themselves do not expire. Monitor proactively rather than reactively (see Error Handling Best Practices for retry and backoff guidance).

Architecturally, support both protection models (see Field-Level vs. Message-Level Encryption) with independently rotated keys per model.

Standard production guidance:

• Log all API requests and responses, including timestamps, status codes, and error fields
• Set alerts on error rate thresholds and latency spikes
• Review Errors and Troubleshooting to understand which error codes warrant immediate action vs. client-side retry