eac_*). People can use them directly.
GET /card-external-accounts lists a user’s saved cards with brand and last four digits. It never returns the card number. The API key or agent key needs the wallets.read scope.
Agents pay with a saved card through agent checkout: browser tokens or agent tokens. Listing saved cards doesn’t let an agent pay with them. That needs the separate saved_cards.use scope, which customers see as Use saved cards when they approve a connection.