diff --git a/CLAUDE.md b/CLAUDE.md
index 50c4c44..4ebf8f0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -104,6 +104,8 @@ Entry point: `main.go` → opens SQLite DB → runs CLI or starts HTTP server on
 - `/admin` — React SPA admin UI (static assets + SPA index fallback, PathPrefix without trailing slash)
 - `/admin/api/` — Admin JSON API (cookie-based session auth, 21 endpoints)
 - `/new`, `/batch`, `/wipe` — Bolt Card Programmer endpoints (`/wipe?s=<secret>` returns a card's keys for the admin Wipe Card deeplink so the app can reset the physical chip)
+
+> **`POST /batch?s=<secret>` mints a real card on every call** — there is no idempotency and no preview mode. `db.Db_dispense_batch_card` (`db/db_tx.go`) claims a slot and inserts the card in one `BEGIN IMMEDIATE` transaction: it checks the batch's expiry window, refuses past `max_group_num` (`program_cards.cards_issued`, schema v14; `0` = no limit), and credits `initial_balance` as a settled `card_receipt` so the card arrives funded. Errors come back as `{"status": "ERROR", "reason": ...}` with a 4xx — `"batch limit reached"` vs `"program card expired or not found"`. Before v0.24.0 neither `max_group_num` nor `initial_balance` was enforced or applied, so a batch link was an unlimited card printing press (WWT-140).
 - BoltCardHub API (`/create`, `/auth`, `/balance`, `/payinvoice`, etc.) — LndHub-compatible, feature-gated via `bolt_card_hub_api` setting
 - PoS API (`/pos/`) — Point-of-Sale subset of LndHub API, feature-gated via `bolt_card_pos_api` setting
 - `/admin/api/websocket` — Real-time payment notifications (JSON events via `wsHub` broadcast, requires admin session cookie)
@@ -130,7 +132,7 @@ SQLite at `/card_data/cards.db` with WAL mode, FULL synchronous, foreign keys, s
 
 **Tables:** `settings` (key-value config), `cards` (card keys/auth/limits), `card_payments` (spending), `card_receipts` (loading/receiving), `program_cards` (batch programming), `pay_link_addresses` (rotating pay-link addresses), `admin_withdrawals` (admin payout audit log)
 
-Schema version managed by idempotent `update_schema_*` functions in `db_create.go`. Current schema version: 13. (v13 adds `wipe_secret`/`wipe_secret_expiry` columns to `cards` — the transient capability token for the admin Wipe Card deeplink; see `web/bcp_wipe.go`.)
+Schema version managed by idempotent `update_schema_*` functions in `db_create.go`. Current schema version: 14. (v13 adds `wipe_secret`/`wipe_secret_expiry` columns to `cards` — the transient capability token for the admin Wipe Card deeplink; see `web/bcp_wipe.go`. v14 adds `program_cards.cards_issued`, the batch slot counter; see below.)
 
 **Admin withdrawals:** the `admin_withdrawals` table (schema v12) is an audit log of admin-initiated payouts of node liquidity (paying out the hub's own funds, not tied to any card). Each row records the destination Lightning address, amount, routing fee, payment hash, and status (`pending`/`paid`/`failed`). See `db/db_admin_withdrawal.go`.
 
diff --git a/docker/card/admin-ui/src/components/batch-program-dialog.tsx b/docker/card/admin-ui/src/components/batch-program-dialog.tsx
index dfb19cf..0af18f3 100644
--- a/docker/card/admin-ui/src/components/batch-program-dialog.tsx
+++ b/docker/card/admin-ui/src/components/batch-program-dialog.tsx
@@ -151,6 +151,11 @@ export function BatchProgramDialog() {
                 One link programs up to this many cards. Leave at 1 for a single card.
               </p>
             )}
+            {Number(form.initialBalance) > 0 && (
+              <p className="text-xs text-muted-foreground">
+                Each card is credited with this balance as it is programmed.
+              </p>
+            )}
 
             <button
               type="button"
diff --git a/docker/card/build/build.go b/docker/card/build/build.go
index 9270cbb..3806086 100644
--- a/docker/card/build/build.go
+++ b/docker/card/build/build.go
@@ -1,5 +1,5 @@
 package build
 
-var Version string = "0.23.2"
+var Version string = "0.24.0"
 var Date string
 var Time string
diff --git a/docker/card/db/db_create.go b/docker/card/db/db_create.go
index 7df1d10..2f3a00e 100644
--- a/docker/card/db/db_create.go
+++ b/docker/card/db/db_create.go
@@ -397,6 +397,24 @@ func update_schema_12(db *sql.DB) {
 	}
 }
 
+func update_schema_13(db *sql.DB) {
+
+	// Number of cards dispensed by a batch so far. Db_dispense_batch_card
+	// increments it under the write lock and refuses to go past
+	// max_group_num, so a /batch?s= link mints at most the number of cards
+	// the admin asked for (0 = no limit).
+	sqlStmt := `
+		BEGIN TRANSACTION;
+		ALTER TABLE program_cards ADD COLUMN cards_issued INTEGER NOT NULL DEFAULT 0;
+		UPDATE settings SET value='14' WHERE name='schema_version_number';
+		COMMIT TRANSACTION;
+	`
+	_, err := db.Exec(sqlStmt)
+	if err != nil {
+		log.Printf("update_schema_13 alter error: %q", err)
+	}
+}
+
 // randomHex8 generates an 8-character random hex string for lightning addresses.
 func randomHex8() string {
 	b := make([]byte, 4)
diff --git a/docker/card/db/db_init.go b/docker/card/db/db_init.go
index 0ebbaa1..fe22fe0 100644
--- a/docker/card/db/db_init.go
+++ b/docker/card/db/db_init.go
@@ -69,7 +69,11 @@ func Db_init(db_conn *sql.DB) {
 		update_schema_12(db_conn) // wipe_secret columns (admin wipe deeplink)
 	}
 
-	if Db_get_setting(db_conn, "schema_version_number") != "13" {
+	if Db_get_setting(db_conn, "schema_version_number") == "13" {
+		update_schema_13(db_conn) // program_cards.cards_issued (batch slot counter)
+	}
+
+	if Db_get_setting(db_conn, "schema_version_number") != "14" {
 		panic("database schema is not as expected")
 	}
 
diff --git a/docker/card/db/db_select.go b/docker/card/db/db_select.go
index fca2aed..3696186 100644
--- a/docker/card/db/db_select.go
+++ b/docker/card/db/db_select.go
@@ -329,14 +329,15 @@ type ProgramCard struct {
 	InitialBalance int
 	CreateTime     int
 	ExpireTime     int
+	CardsIssued    int
 }
 
 func Db_select_program_card_for_secret(db_conn *sql.DB, secret string) (result ProgramCard) {
 	var programCard ProgramCard
 
 	// get card id
-	sqlStatement := `SELECT secret, group_tag, max_group_num, initial_balance, create_time, expire_time` +
-		` FROM program_cards WHERE secret = $1;`
+	sqlStatement := `SELECT secret, group_tag, max_group_num, initial_balance, create_time, expire_time,` +
+		` cards_issued FROM program_cards WHERE secret = $1;`
 	rows, err := db_conn.Query(sqlStatement, secret)
 	if err != nil {
 		log.Error("db_select_program_card_for_secret query error: ", err)
@@ -351,7 +352,8 @@ func Db_select_program_card_for_secret(db_conn *sql.DB, secret string) (result P
 			&programCard.MaxGroupNum,
 			&programCard.InitialBalance,
 			&programCard.CreateTime,
-			&programCard.ExpireTime)
+			&programCard.ExpireTime,
+			&programCard.CardsIssued)
 		if err != nil {
 			log.Error("db_select_program_card_for_secret scan error: ", err)
 		}
diff --git a/docker/card/db/db_test.go b/docker/card/db/db_test.go
index 516d8d9..41d65f2 100644
--- a/docker/card/db/db_test.go
+++ b/docker/card/db/db_test.go
@@ -2,9 +2,11 @@ package db
 
 import (
 	"database/sql"
+	"errors"
 	"os"
 	"strings"
 	"testing"
+	"time"
 )
 
 func openTestDB(t *testing.T) *sql.DB {
@@ -23,8 +25,8 @@ func TestDbInit_SchemaMigratesToLatest(t *testing.T) {
 	Db_init(db)
 
 	version := Db_get_setting(db, "schema_version_number")
-	if version != "13" {
-		t.Fatalf("expected schema version 13, got %q", version)
+	if version != "14" {
+		t.Fatalf("expected schema version 14, got %q", version)
 	}
 }
 
@@ -1099,3 +1101,163 @@ func TestDbInsertCard_UniqueLnAddresses(t *testing.T) {
 		t.Fatalf("expected unique ln_addresses, both got %q", card1.Ln_address)
 	}
 }
+
+// --- Db_dispense_batch_card tests (batch slot enforcement) ---
+
+func insertTestBatch(t *testing.T, db_conn *sql.DB, secret string, maxCards int, initialBalance int) {
+	t.Helper()
+	now := int(time.Now().Unix())
+	Db_insert_program_cards(db_conn, secret, "batchtag", maxCards, initialBalance, now-60, now+3600)
+}
+
+func testBatchKeys() CardKeys {
+	return CardKeys{Key0: "k0", Key1: "k1", Key2: "k2", Key3: "k3", Key4: "k4"}
+}
+
+func countCards(t *testing.T, db_conn *sql.DB) int {
+	t.Helper()
+	var n int
+	if err := db_conn.QueryRow(`SELECT count(*) FROM cards`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
+
+func TestDbDispenseBatchCard_CreatesCardAndCountsIssue(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+	insertTestBatch(t, db_conn, "s1", 10, 0)
+
+	cardId, groupTag, err := Db_dispense_batch_card(db_conn, "s1", "04AABBCCDDEE80", testBatchKeys(), "login1", "pass1")
+	if err != nil {
+		t.Fatalf("expected dispense to succeed, got %v", err)
+	}
+	if cardId == 0 {
+		t.Fatal("expected a card id")
+	}
+	if groupTag != "batchtag" {
+		t.Fatalf("expected group tag 'batchtag', got %q", groupTag)
+	}
+
+	var uid, tag, lnurlwEnable string
+	err = db_conn.QueryRow(`SELECT uid, group_tag, lnurlw_enable FROM cards WHERE card_id=$1`,
+		cardId).Scan(&uid, &tag, &lnurlwEnable)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if uid != "04AABBCCDDEE80" {
+		t.Fatalf("expected uid to be stored, got %q", uid)
+	}
+	if tag != "batchtag" {
+		t.Fatalf("expected group_tag 'batchtag', got %q", tag)
+	}
+	if lnurlwEnable != "Y" {
+		t.Fatalf("expected withdrawals enabled, got %q", lnurlwEnable)
+	}
+
+	pc := Db_select_program_card_for_secret(db_conn, "s1")
+	if pc.CardsIssued != 1 {
+		t.Fatalf("expected cards_issued 1, got %d", pc.CardsIssued)
+	}
+}
+
+func TestDbDispenseBatchCard_EnforcesMaxGroupNum(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+	insertTestBatch(t, db_conn, "s1", 2, 0)
+
+	for i := 0; i < 2; i++ {
+		if _, _, err := Db_dispense_batch_card(db_conn, "s1", "", testBatchKeys(), "login", "pass"); err != nil {
+			t.Fatalf("dispense %d should succeed, got %v", i+1, err)
+		}
+	}
+
+	_, _, err := Db_dispense_batch_card(db_conn, "s1", "", testBatchKeys(), "login", "pass")
+	if !errors.Is(err, ErrBatchExhausted) {
+		t.Fatalf("expected ErrBatchExhausted, got %v", err)
+	}
+	if n := countCards(t, db_conn); n != 2 {
+		t.Fatalf("expected 2 cards, got %d", n)
+	}
+	pc := Db_select_program_card_for_secret(db_conn, "s1")
+	if pc.CardsIssued != 2 {
+		t.Fatalf("expected cards_issued to stay at 2, got %d", pc.CardsIssued)
+	}
+}
+
+func TestDbDispenseBatchCard_ZeroMaxIsUnlimited(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+	insertTestBatch(t, db_conn, "s1", 0, 0)
+
+	for i := 0; i < 3; i++ {
+		if _, _, err := Db_dispense_batch_card(db_conn, "s1", "", testBatchKeys(), "login", "pass"); err != nil {
+			t.Fatalf("dispense %d should succeed with no limit, got %v", i+1, err)
+		}
+	}
+	if n := countCards(t, db_conn); n != 3 {
+		t.Fatalf("expected 3 cards, got %d", n)
+	}
+}
+
+func TestDbDispenseBatchCard_CreditsInitialBalance(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+	insertTestBatch(t, db_conn, "s1", 10, 5000)
+
+	cardId, _, err := Db_dispense_batch_card(db_conn, "s1", "", testBatchKeys(), "login", "pass")
+	if err != nil {
+		t.Fatalf("expected dispense to succeed, got %v", err)
+	}
+
+	if balance := Db_get_card_balance(db_conn, cardId); balance != 5000 {
+		t.Fatalf("expected balance 5000, got %d", balance)
+	}
+}
+
+func TestDbDispenseBatchCard_ZeroInitialBalanceAddsNoReceipt(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+	insertTestBatch(t, db_conn, "s1", 10, 0)
+
+	cardId, _, err := Db_dispense_batch_card(db_conn, "s1", "", testBatchKeys(), "login", "pass")
+	if err != nil {
+		t.Fatalf("expected dispense to succeed, got %v", err)
+	}
+
+	var n int
+	if err := db_conn.QueryRow(`SELECT count(*) FROM card_receipts WHERE card_id=$1`, cardId).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("expected no receipt for a zero initial balance, got %d", n)
+	}
+}
+
+func TestDbDispenseBatchCard_ExpiredBatch(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+	now := int(time.Now().Unix())
+	Db_insert_program_cards(db_conn, "expired", "batchtag", 10, 0, now-7200, now-3600)
+
+	_, _, err := Db_dispense_batch_card(db_conn, "expired", "", testBatchKeys(), "login", "pass")
+	if !errors.Is(err, ErrBatchExpired) {
+		t.Fatalf("expected ErrBatchExpired, got %v", err)
+	}
+	if n := countCards(t, db_conn); n != 0 {
+		t.Fatalf("expected no card to be created, got %d", n)
+	}
+}
+
+func TestDbDispenseBatchCard_UnknownSecret(t *testing.T) {
+	db_conn := openTestDB(t)
+	Db_init(db_conn)
+
+	_, _, err := Db_dispense_batch_card(db_conn, "nosuchsecret", "", testBatchKeys(), "login", "pass")
+	if !errors.Is(err, ErrBatchNotFound) {
+		t.Fatalf("expected ErrBatchNotFound, got %v", err)
+	}
+	if n := countCards(t, db_conn); n != 0 {
+		t.Fatalf("expected no card to be created, got %d", n)
+	}
+}
diff --git a/docker/card/db/db_tx.go b/docker/card/db/db_tx.go
index 1f1b042..2778e7a 100644
--- a/docker/card/db/db_tx.go
+++ b/docker/card/db/db_tx.go
@@ -1,9 +1,11 @@
 package db
 
 import (
+	"card/util"
 	"context"
 	"database/sql"
 	"errors"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -21,6 +23,101 @@ var ErrTxLimitExceeded = errors.New("transaction limit exceeded")
 // means no limit.
 var ErrDayLimitExceeded = errors.New("daily limit exceeded")
 
+// ErrBatchNotFound is returned when no program_cards row matches the secret.
+var ErrBatchNotFound = errors.New("batch not found")
+
+// ErrBatchExpired is returned when the batch exists but the current time is
+// outside its create_time..expire_time window.
+var ErrBatchExpired = errors.New("batch expired")
+
+// ErrBatchExhausted is returned when a batch has already dispensed
+// max_group_num cards. A max_group_num of 0 means no limit.
+var ErrBatchExhausted = errors.New("batch limit reached")
+
+// Db_dispense_batch_card atomically validates a batch secret, claims one of
+// its card slots and creates the card, all inside a single BEGIN IMMEDIATE
+// transaction so concurrent dispenses cannot both read a stale cards_issued
+// and overshoot max_group_num.
+//
+// When the batch carries an initial_balance the card is credited with a paid
+// card_receipt in the same transaction, so a dispensed card is never visible
+// with the wrong balance.
+//
+// Returns the new card's id and the batch's group tag.
+func Db_dispense_batch_card(db_conn *sql.DB, secret string, uid string, keys CardKeys,
+	login string, password string) (cardId int, groupTag string, err error) {
+
+	lnAddress := "c." + randomHex8()
+
+	err = withImmediateTx(db_conn, func(ctx context.Context, conn *sql.Conn) error {
+
+		// read the batch under the write lock so the limit check below
+		// cannot race with a concurrent dispense
+		var maxGroupNum, initialBalance, createTime, expireTime, cardsIssued int
+		batchSQL := `SELECT group_tag, max_group_num, initial_balance,
+			create_time, expire_time, cards_issued
+			FROM program_cards WHERE secret = $1`
+		err := conn.QueryRowContext(ctx, batchSQL, secret).Scan(&groupTag,
+			&maxGroupNum, &initialBalance, &createTime, &expireTime, &cardsIssued)
+		if errors.Is(err, sql.ErrNoRows) {
+			return ErrBatchNotFound
+		}
+		if err != nil {
+			return err
+		}
+
+		now := int(time.Now().Unix())
+		if now < createTime || now > expireTime {
+			return ErrBatchExpired
+		}
+
+		// batch size limit (0 = no limit)
+		if maxGroupNum > 0 && cardsIssued >= maxGroupNum {
+			return ErrBatchExhausted
+		}
+
+		// claim the slot
+		claimSQL := `UPDATE program_cards SET cards_issued = cards_issued + 1 WHERE secret = $1`
+		if _, err := conn.ExecContext(ctx, claimSQL, secret); err != nil {
+			return err
+		}
+
+		// lnurlw_enable set explicitly ('Y') — see Db_insert_card for why.
+		insertSQL := `INSERT INTO cards (key0_auth, key1_enc, key2_cmac, key3, key4,
+			login, password, uid, group_tag, ln_address, lnurlw_enable)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'Y');`
+		res, err := conn.ExecContext(ctx, insertSQL, keys.Key0, keys.Key1, keys.Key2,
+			keys.Key3, keys.Key4, login, password, uid, groupTag, lnAddress)
+		if err != nil {
+			return err
+		}
+		id, err := res.LastInsertId()
+		if err != nil {
+			return err
+		}
+		cardId = int(id)
+
+		// credit the batch's initial balance as a settled receipt, mirroring
+		// adminApiAllocateFunds. r_hash_hex is UNIQUE and there is no real
+		// invoice behind an allocation, so use a random value.
+		if initialBalance > 0 {
+			receiptSQL := `INSERT INTO card_receipts (card_id, ln_invoice, r_hash_hex,
+				amount_sats, paid_flag, timestamp, expire_time)
+				VALUES ($1, '', $2, $3, 'Y', unixepoch(), unixepoch() + 86400);`
+			if _, err := conn.ExecContext(ctx, receiptSQL, cardId, util.Random_hex(), initialBalance); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return 0, "", err
+	}
+	return cardId, groupTag, nil
+}
+
 // withImmediateTx runs fn inside a BEGIN IMMEDIATE transaction on a
 // single pinned connection. BEGIN IMMEDIATE acquires the SQLite write
 // lock at transaction start, preventing other writers from interleaving
diff --git a/docker/card/web/admin_api_cards.go b/docker/card/web/admin_api_cards.go
index f767634..227e992 100644
--- a/docker/card/web/admin_api_cards.go
+++ b/docker/card/web/admin_api_cards.go
@@ -301,6 +301,14 @@ func (app *App) adminApiBatchCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// each dispensed card is credited with initialBalance, so a negative
+	// value has no meaning
+	if req.InitialBalance < 0 {
+		w.WriteHeader(http.StatusBadRequest)
+		writeJSON(w, map[string]string{"error": "initialBalance cannot be negative"})
+		return
+	}
+
 	secret := util.Random_hex()
 	createTime := int(time.Now().Unix())
 	expireTime := createTime + req.ExpiryHours*60*60
diff --git a/docker/card/web/admin_api_test.go b/docker/card/web/admin_api_test.go
index 889f880..e690a75 100644
--- a/docker/card/web/admin_api_test.go
+++ b/docker/card/web/admin_api_test.go
@@ -983,6 +983,24 @@ func TestAdminApiBatchCreate_InvalidInput(t *testing.T) {
 	}
 }
 
+func TestAdminApiBatchCreate_RejectsNegativeBalance(t *testing.T) {
+	app := openTestApp(t)
+	token := setupAdminSession(t, app)
+
+	handler := app.CreateHandler_AdminApi()
+	body := `{"groupTag":"g","maxCards":5,"initialBalance":-1,"expiryHours":24}`
+	r := httptest.NewRequest("POST", "/admin/api/batch/create",
+		strings.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
+	r.AddCookie(&http.Cookie{Name: "admin_session_token", Value: token})
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, r)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for a negative initial balance, got %d", w.Code)
+	}
+}
+
 func TestAdminApiCardRouter_InvalidId(t *testing.T) {
 	app := openTestApp(t)
 	token := setupAdminSession(t, app)
diff --git a/docker/card/web/bcp_batch_create.go b/docker/card/web/bcp_batch_create.go
index 44c3974..3053da8 100644
--- a/docker/card/web/bcp_batch_create.go
+++ b/docker/card/web/bcp_batch_create.go
@@ -4,8 +4,8 @@ import (
 	"card/db"
 	"card/util"
 	"encoding/json"
+	"errors"
 	"net/http"
-	"time"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -22,6 +22,20 @@ type BcpBatchResponse struct {
 	UIDPrivacy string `json:"uid_privacy"` // looks like this is not in the BCP app yet
 }
 
+// bcpError replies with the Bolt Card Programmer error shape used by /new
+// ({"status": "ERROR", "reason": ...}) alongside an HTTP error status, so a
+// client can tell an exhausted batch from an expired one.
+func bcpError(w http.ResponseWriter, status int, reason string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(map[string]string{
+		"status": "ERROR",
+		"reason": reason,
+	}); err != nil {
+		log.Error("bcpError encode error: ", err)
+	}
+}
+
 func (app *App) CreateHandler_BatchCreateCard() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 
@@ -47,21 +61,32 @@ func (app *App) CreateHandler_BatchCreateCard() http.HandlerFunc {
 
 		log.Info("Uid : ", t.Uid)
 
-		// check secret in program_cards exists and is not expired, and get group_tag field
-		programCard := db.Db_select_program_card_for_secret(app.db_read, secret)
-		currentTime := int(time.Now().Unix())
+		// Claim a slot in the batch and create the card in one transaction:
+		// the secret has to be live, within its expiry window, and still have
+		// cards left on its max_group_num allowance. Each POST here mints a
+		// real card, so an unbounded batch link is a card printing press.
+		k0, k1, k2, k3, k4 := generateCardKeys()
+		keys := db.CardKeys{Key0: k0, Key1: k1, Key2: k2, Key3: k3, Key4: k4}
+		login := util.Random_hex()
+		password := util.Random_hex()
 
-		if currentTime < programCard.CreateTime || currentTime > programCard.ExpireTime {
-			log.Warn("ProgramCard record within expiry time not found")
-			http.Error(w, "program card expired or not found", http.StatusBadRequest)
+		cardId, _, err := db.Db_dispense_batch_card(app.db_write, secret, t.Uid, keys, login, password)
+		if err != nil {
+			switch {
+			case errors.Is(err, db.ErrBatchExhausted):
+				log.Warn("batch has already dispensed all of its cards")
+				bcpError(w, http.StatusBadRequest, "batch limit reached")
+			case errors.Is(err, db.ErrBatchNotFound), errors.Is(err, db.ErrBatchExpired):
+				log.Warn("ProgramCard record within expiry time not found")
+				bcpError(w, http.StatusBadRequest, "program card expired or not found")
+			default:
+				log.Error("batch card dispense error: ", err)
+				bcpError(w, http.StatusInternalServerError, "could not create card")
+			}
 			return
 		}
 
-		// create a new card in the database
-		k0, k1, k2, k3, k4 := generateCardKeys()
-		login := util.Random_hex()
-		password := util.Random_hex()
-		db.Db_insert_card_with_uid(app.db_write, k0, k1, k2, k3, k4, login, password, t.Uid, programCard.GroupTag)
+		log.Info("batch dispensed card_id ", cardId)
 
 		var bcpBatchResponse BcpBatchResponse
 
diff --git a/docker/card/web/web_test.go b/docker/card/web/web_test.go
index 7cb27ad..730d015 100644
--- a/docker/card/web/web_test.go
+++ b/docker/card/web/web_test.go
@@ -2219,6 +2219,60 @@ func TestBatchCreateCard_ExpiredProgram(t *testing.T) {
 	}
 }
 
+func TestBatchCreateCard_ExhaustedBatch(t *testing.T) {
+	app := openTestApp(t)
+	now := int(time.Now().Unix())
+	db.Db_insert_program_cards(app.db_write, "onecard", "group1", 1, 0, now-60, now+3600)
+	handler := app.CreateHandler_BatchCreateCard()
+
+	body := `{"UID":"048B71B22D6B80"}`
+	r := httptest.NewRequest("POST", "/batch?s=onecard", strings.NewReader(body))
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, r)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected first dispense to succeed, got %d: %s", w.Code, w.Body.String())
+	}
+
+	r = httptest.NewRequest("POST", "/batch?s=onecard", strings.NewReader(body))
+	w = httptest.NewRecorder()
+	handler.ServeHTTP(w, r)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 once the batch is used up, got %d", w.Code)
+	}
+	if !strings.Contains(w.Body.String(), "batch limit reached") {
+		t.Fatalf("expected 'batch limit reached', got %q", w.Body.String())
+	}
+
+	cards := db.Db_select_cards_with_group_tag(app.db_read, "group1")
+	if len(cards) != 1 {
+		t.Fatalf("expected the batch to have minted 1 card, got %d", len(cards))
+	}
+}
+
+func TestBatchCreateCard_CreditsInitialBalance(t *testing.T) {
+	app := openTestApp(t)
+	now := int(time.Now().Unix())
+	db.Db_insert_program_cards(app.db_write, "fundedbatch", "group2", 10, 2500, now-60, now+3600)
+	handler := app.CreateHandler_BatchCreateCard()
+
+	r := httptest.NewRequest("POST", "/batch?s=fundedbatch", strings.NewReader(`{"UID":"048B71B22D6B80"}`))
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	cards := db.Db_select_cards_with_group_tag(app.db_read, "group2")
+	if len(cards) != 1 {
+		t.Fatalf("expected 1 card, got %d", len(cards))
+	}
+	if balance := db.Db_get_card_balance(app.db_read, cards[0].CardId); balance != 2500 {
+		t.Fatalf("expected the card to arrive with 2500 sats, got %d", balance)
+	}
+}
+
 // --- PoS API Tests ---
 
 func TestPosGetInfo_ReturnsEmpty(t *testing.T) {