Grok Bot can now complete purchases via Stripe Link with per-purchase approval

Grok Bot can now pay for things

xAI's Grok Bot can now carry a purchase through to completion using a connected Stripe Link wallet, according to a write-up on dev.to. The design keeps payment credentials away from the agent: Grok never sees a card number. Instead, when it wants to buy something, it raises an approval prompt naming the merchant and the amount. Only after the user approves does Stripe Link issue a one-time-use virtual card to settle that specific transaction. If the user does not respond, the request expires after about ten minutes.

How the flow works

As described in the dev.to post, a purchase runs through a few distinct stages:

• The user connects a Stripe Link wallet, Stripe's saved-payment checkout wallet, to Grok Bot.
• When the agent identifies something to buy, it generates an approval request showing who would be paid and how much.
• On approval, Link creates a single-use virtual card number for that purchase, which becomes worthless once the transaction completes.
• An approval left unanswered for roughly ten minutes lapses on its own.

The effect is that the durable secret, the real card, never leaves Stripe's side. The agent operates with narrow, expiring, per-transaction authorization rather than a reusable credential it could hold onto, replay, or leak.

A card-photo suggestion that got flagged

The post also recounts a sideshow from the rollout. Elon Musk reportedly suggested sharing a photo of a payment card with the bot, advice that drew a correction on his own platform: X's Community Notes feature flagged it, pointing to xAI's own terms, which warn users against putting personal information into prompts. The dev.to author's recommendation is to disregard that route entirely, rely on the approval flow as intended, and, for added safety, connect a virtual card with a low spending limit.

What remains unanswered

Several practical details are still unclear, the post notes: which countries the feature works in, whether any spending limits apply, and how refunds or disputes are handled when a purchase was executed by an agent rather than directly by the cardholder. Until those questions are documented, the feature is easier to evaluate as infrastructure than as a finished consumer product.

Why it matters

The significant part is less about Grok specifically and more about the plumbing. Letting an AI agent spend money has an obvious trust problem: a reusable card number in an agent's hands is a standing liability, and a fully autonomous checkout is a fraud vector. This integration splits the difference with three primitives — per-purchase human approval, single-use payment tokens, and automatic expiry — that let an agent complete real transactions without ever holding a credential it could reuse.

That is roughly the minimum trust architecture any shopping agent needs, and it maps onto the direction the payments industry has been heading as agentic commerce moves from demos to shipped features. If the pattern holds, agents become the initiators of purchases while wallet providers remain the custodians of credentials, with the human kept in the loop as the approval step between the two.