You can now build the card form from individual field elements, arrange them in any order or row, split the expiry date into month and year, and add your own non-card fields (postal code, email, etc.). There are also new theming options that make it easier to match the form to your brand. The form itself loads faster too, and can be preloaded so it appears instantly at checkout. There are no breaking changes for existing integrations. Check out the SDK and card collection docs for more details.

agentTools lets AI agents fill in the card form through WebMCP. It's quick to enable, and lets agents check, focus, and enter values into each field. Values entered by agents go through the same encryption and validation as values typed by customers. They're emitted through the normal change and complete events, so your existing checkout logic handles agent-filled forms without changes and remains secure.

For 3DS, we now support Visa DCAP. It uses Visa's Data Only flow to send enriched transaction data instead of a full challenge, giving customers a frictionless checkout and lowering interchange fees on eligible transactions.

New and upcoming features

• Visa DCAP is a program that reduces interchange fees for eligible transactions using Visa’s Data Only authentication flow. By sending enriched transaction data for risk assessment instead of a full 3DS challenge, it enables a frictionless checkout experience while lowering merchant costs. 

• Card Collection components have been updated to be more composable, customizable, and faster. You can rearrange fields, add custom fields, and more. These changes are non-breaking, so you can pull them in when you want.

• Intelligent Retries give you stronger signals for when to retry declined transactions, helping you to recover lost revenue.

• Real-time Account Updater ensures you have the latest card number and expiration date for customers' cards. It helps maintain seamless billing without customers manually updating their card details. This results in higher authorization rates and reduced friction for customers.

Client-Side SDKs

JavaScript

• Added the <ev-card> HTML tag, which renders the default card collection form (number, expiry, and CVC) with a single line of markup and fires the same change events as ui.card()

• Added field elements for <ev-card> (<ev-card-holder>, <ev-card-number>, <ev-card-expiry>, and <ev-card-cvc>), which render in the order you declare them, plus <ev-row> to place fields side by side

• Added the option to build your own field tree with ui.card(), so you can create the same custom layouts from a config object

• Added <ev-card-expiry-month> and <ev-card-expiry-year> to collect the expiry date as two separate fields, while still reporting a single expiry in the card payload

• Added <ev-field> for collecting your own non-card data, like a postcode or email address, inside the card, with each value encrypted and returned in a new fields object on the card payload

• Added browser-style validation for custom fields, including required, pattern, length limits, and email and URL formats, with errors reported under errors.fields

• Added per-field settings, including label, placeholder, tooltip, autofocus, and errormessage, set directly on each field element

• Added per-field autoProgress and autoComplete options to ui.card(), including settings for split expiry and custom fields

• Improved auto-progress to follow the order fields render in, move back to the previous field on backspace, and advance once the CVC is complete

• Fixed auto-progress stopping at the card number on cards that don't render an expiry field

• Added an opt-in agentTools option that registers WebMCP tools so AI agents can check form status, focus fields, and enter values

• Added an exposeTo origin allowlist for agentTools, plus namePrefix and productName options for white-label integrations

• Added card.preload(selector) and card.show() so the card iframe loads hidden in the background and appears instantly when show() is called

• Code-split the card collection iframes so each one only downloads the code for the component it renders, making load times 10% faster in our testing

• Added a fontFaces theme option for self-hosted brand fonts, passed as base64, with validation that rejects fonts that could be used to visually spoof digits

• Added semantic theme styles (font, roundness, greyTone, and primary) and a selectors override for simplified styling

• Added a cssVar helper so themes can read CSS variables from your page to avoid hardcoding styles and style drift

React

• Added field components to <Card> (Card.Holder, Card.Number, Card.Expiry, Card.ExpiryMonth, Card.ExpiryYear, Card.Cvc, Card.Field, and Card.Row), which render the <ev-card> elements

• Added Card.ExpiryMonth and Card.ExpiryYear to collect the expiry date as two separate fields, while still reporting a single expiry in the card payload

• Added Card.Field for collecting your own non-card data, like a postcode or email address, inside the card, with each value encrypted and returned in a new fields object on the card payload

• Added browser-style validation for custom fields, including required, pattern, length limits, and email and URL formats, with errors reported under errors.fields

• Added per-field settings, including label, placeholder, tooltip, autofocus, and errormessage, set as props on each field component

• Deprecated the fields, redactCVC, and allow3DigitAmexCVC props on <Card> in favor of children and props on each field, with existing integrations continuing to work unchanged

• Improved auto-progress to follow the order fields render in, move back to the previous field on backspace, and advance once the CVC is complete

• Fixed auto-progress stopping at the card number on cards that don't render an expiry field

• Added an agentTools prop to <Card> that registers WebMCP tools so AI agents can check form status, focus fields, and enter values

• Added an exposeTo origin allowlist for agentTools, plus namePrefix and productName options for white-label integrations

• Added a preload prop and show() ref method to <Card> so the card iframe loads hidden in the background and appears instantly when show() is called

• Code-split the card collection iframes so each one only downloads the code for the component it renders, making load times 10% faster in our testing

• Added a fontFaces theme option for self-hosted brand fonts, passed as base64, with validation that rejects fonts that could be used to visually spoof digits

• Added semantic theme styles (font, roundness, greyTone, and primary) and a selectors override for simplified styling

• Added a cssVar helper so themes can read CSS variables from your page to avoid hardcoding styles and style drift

React Native

• Added field components to <Card>, including rows, split expiry, and custom fields

• Added labels and auto-advance to card fields

• Improved CVC validation to follow the card number's brand

Android

• Released Google Pay Android SDK v1.0.0, which requires Kotlin 2.1 or later for anyone upgrading from a previous version

• Added the ability to approve or reject payments inside the Google Pay sheet, so end users can try another card if a check fails

• Added opt-in collection of billing addresses, phone numbers, and payer email addresses

• Added the payment method type, card display name, last four digits, and optional Google Pay assurance details to responses

• Fixed cancellation and error handling so cancelling the sheet returns a distinct cancelled state and the payment button becomes available again

Server-Side SDKs

Java

• Added offline encryption in v4.3.1, letting you initialize the SDK from a JSON Web Key Set (JWKS) downloaded from keys.evervault.com, so encryption works without an internet connection

Payments

• Added support for Visa Data Only authentication in 3DS sessions, with new deviceId and clientIp fields on the customer object when creating a session

• Added a dcap object to Visa data-sharing 3DS session responses, showing whether the session qualified and was accepted

Dashboard

• Added self-serve plan upgrades through an embedded checkout

• Added the ability to view and download past and upcoming invoices

• Added a usage view for teams on metered products, showing usage and amount accrued this period with per-event rates on hover

• Improved the checkout loading state to show a single loader until checkout renders

• Updated checkout fonts and colors to match Evervault branding

Functions

• Added support for Node.js 22 and 24, and Python 3.11, 3.12, 3.13, and 3.14

• The latest CLI version now rejects new functions created with obsolete runtimes (Python 3.9 and Node.js 16 through 20)