[hiroTamada]

Summary

Adds Embedded Card Capture under Payments: how to collect a card for a KERNEL wallet (provider: "kernel") on your own branded page with KernelCardCapture from @onkernel/vault-react, instead of the hosted card_enrollment page.

The page covers:

• creating the wallet and reading action.capture_token (TypeScript and Python)
• rendering the component and its props
• styling: class hooks for the surrounding form, fieldCss for the VGS iframes, and labels (with a note that the defaults are KERNEL's copy)
• the CSP directives the integrator needs
• confirming completion from the backend, the fixed error codes, token lifetime and renewal, and security guidance
• the limitation that Visa purchase approval stays on the KERNEL-hosted spend_approval page

Do not merge yet

This documents unreleased behavior. Merge only after:

1. The API change that adds capture_token and cross-origin card capture is deployed.
2. A @onkernel/vault-react release that includes KernelCardCapture is published (the latest on npm, 0.2.0, doesn't include it).
3. The SDKs are regenerated with capture_token on the card_enrollment action, so the TypeScript and Python examples type-check.

Testing

• mint dev renders the page; mint broken-links reports no broken links.
• Examples were not run against a released SDK, since capture_token isn't in the SDKs yet.

---

Note

Low Risk
Documentation-only changes with no runtime or API code; integrators may rely on unreleased capture_token and package behavior until those ship.

Overview
Adds Embedded Card Capture to the Payments docs nav and a new guide for collecting KERNEL wallet cards on integrators’ own pages via @onkernel/vault-react’s KernelCardCapture, instead of the hosted card_enrollment URL.

The page documents the end-to-end flow: backend wallet creation and action.capture_token, React integration (props, direct browser API calls), styling via class hooks and fieldCss for VGS iframes, required CSP allowances, backend wallet confirmation after onComplete, fixed onError codes, 30-minute token renewal, and security handling for the capability token. It also notes that Visa spend_approval remains KERNEL-hosted while only card enrollment is embeddable.

^{Reviewed by Cursor Bugbot for commit 2ccb56f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Oct 21, 2026, 12:52 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[chruffins]

One accuracy concern: the resend on pagehide/unmount is fire-and-forget and suppresses request failures, so it cannot guarantee the card is recorded. Could this say the component attempts a best-effort resend and reiterate that the backend must verify wallet state? The earlier completion section already recommends verification; this sentence currently overstates the guarantee.

[chruffins]

This resend is best-effort: the component ignores failures from the unmount/pagehide request, so the card can still remain unrecorded. Please phrase this as an attempt rather than a guarantee (and point readers to the backend wallet-state check).