In the previous post we made your catalog readable: clean feeds, structured data, and product pages an agent can actually parse. Now the agent can find you and understand what you sell. This post is about the next step, the one that involves money: the agent building a cart and completing a purchase on a shopper's behalf. That single action touches your checkout, your payment processor, the card networks, and the legal question of who is actually selling the product. Get the arrangement wrong and you can end up as a supplier feeding someone else's storefront. Get it right and an agent sells for you while you keep the transaction, the margin, and the customer.
Why an agent buying from you is harder than an agent reading you
Reading is safe. A crawler can misread your page and the worst outcome is a missed recommendation. A purchase is different: it moves money, it creates a legal sale, and it demands trust in three directions at once. The merchant has to trust that the agent is genuinely authorized to spend the shopper's money. The payment network has to trust that the transaction is legitimate and not fraud. And the shopper has to trust that the agent bought the right thing at the right price and did not leak their card. None of that is solved by a good product feed. It needs protocols and payment plumbing built specifically for a machine acting on a human's behalf, which is exactly what the industry has spent the last year shipping.
The three layers of an agentic checkout
It is tempting to treat ACP, UCP, and AP2 as rival standards you have to pick between. They are not. They operate at different levels of the same transaction and stack together. Here is what each layer does.
Commerce protocols: how the agent builds a cart and places the order
This is the layer that lets an agent do commerce things: look up a product, add it to a cart, apply a discount, and submit an order to your store. Two open specifications lead here. The Agentic Commerce Protocol (ACP), from OpenAI and Stripe, powers checkout inside ChatGPT and is published openly on GitHub. Google's Universal Commerce Protocol (UCP) plays the same role across Google's shopping surfaces. They are parallel standards, not the same thing, so treat them as two doors you may want to open rather than a single choice.
What matters to you: both are designed so the order still lands as a sale in your store. The agent orchestrates the checkout; it does not become the seller.
Payment authorization: proving the shopper actually approved this purchase
Before any money moves, someone has to prove the agent was genuinely allowed to spend. Google's Agent Payments Protocol (AP2), announced September 16, 2025 with more than 60 partners including Mastercard, PayPal, and American Express, is the open answer to that question. It uses cryptographically signed mandates: an Intent Mandate that captures what the shopper asked for, and a Cart Mandate that locks the exact items and price they approved. The merchant and the rail can then verify the purchase was authorized by the actual person, not invented by a hallucinating agent.
Why it exists: it closes the accountability gap. If an agent buys the wrong thing, the signed mandate is the record of what the shopper actually authorized. AP2 sits underneath both ACP and UCP, it is not a competitor to them.
Payment rails: moving the money without exposing the card
Finally the money has to move, and the card networks and processors have built agent-aware rails for it. Visa Intelligent Commerce and Mastercard Agent Pay both launched in spring 2025 with tokenized credentials and agent-specific controls. Stripe's Agentic Commerce Suite introduced a Shared Payment Token that is scoped to a single merchant and a single basket, so the agent can complete one purchase without ever seeing the underlying card number. The shared principle across all of them: the agent gets permission to make one payment, not a copy of your customer's card.
The upshot: a scoped, single-use credential limits the damage if something goes wrong, which is what makes networks and banks comfortable letting agents pay at all.
Stay the merchant of record
The most important word in this whole topic is not a protocol name. It is merchant of record: the business that legally sells the product, owns the transaction, and carries the charge, the tax, and the returns. This is the line between an agent selling your product and a platform reselling it. In the first case you keep the customer relationship, the order data, and the margin. In the second you are closer to a wholesaler shipping into someone else's storefront.
The good news is that the leading protocols were designed to keep you in that seat. ACP is explicit that the merchant remains the merchant of record: the AI surface presents your product and relays the order, but the sale is still between you and the shopper. That is not automatic across every possible arrangement, though, which is why it belongs at the top of your due-diligence list. The in-chat checkout landscape is also still moving. OpenAI scaled back parts of its native Instant Checkout in early 2026, and reporting on the economics (including a widely cited 4% platform fee figure, attributed by The Information to Shopify rather than published by OpenAI) is a reminder that terms are unsettled. Read the deal, not the headline.
Do this now: what to ask your platform and payment provider
You almost certainly will not build any of this yourself. You will turn it on through your e-commerce platform and your payment service provider. So the practical work is asking the right questions before you flip the switch. Run this checklist:
- "Do I stay the merchant of record?" Ask it plainly, for each surface. If the answer is no, understand exactly what you are giving up before agreeing.
- "Which protocols do you support?" ACP for ChatGPT, UCP for Google. Knowing which surfaces your platform can reach tells you where agent checkout is even possible for you.
- "How is payment authorized, and do you support AP2-style signed mandates?" You want verifiable proof that the shopper approved the specific cart, not a blanket agent permission.
- "Does the agent ever touch a real card number?" The right answer is no. Confirm your PSP uses scoped tokens (Stripe Shared Payment Token, Visa or Mastercard agent credentials) so a single purchase is all any token can do.
- "Who owns the customer and the order data?" Confirm the email, the order history, and the post-purchase relationship come to you, not just a payout.
- "What are the fees, and are they fixed?" Agent-channel economics are still being set. Get the current number and how it can change in writing.
None of these require you to understand cryptography or write protocol code. They are business questions, and the answers tell you whether a given agent channel is a new storefront working for you or a slow trade of your customer relationship for reach. Next in the series we move from checkout to control at a deeper level: exposing live tools an agent can call directly with MCP and WebMCP. If you run Shopify, our existing walkthrough of WebMCP and Shopify is a hands-on preview.
Frequently asked questions
What does it take for an AI agent to check out from my store?
Three layers have to line up. First, a commerce protocol that lets the agent read your catalog, build a cart, and place the order: the Agentic Commerce Protocol (ACP, from OpenAI and Stripe) and Google's Universal Commerce Protocol (UCP) are the two main ones. Second, a payment authorization layer that proves the shopper actually approved this specific purchase: Google's Agent Payments Protocol (AP2) does this with cryptographically signed mandates. Third, a payment rail that moves the money: Visa Intelligent Commerce, Mastercard Agent Pay, and processors like Stripe. These layers stack on top of each other, they are not competing choices. In practice you enable them through your e-commerce platform and payment provider rather than building them yourself.
What is the merchant of record in agentic commerce, and do I stay it?
The merchant of record is the business that legally sells the product to the customer, owns the transaction, and is responsible for the charge, tax, and returns. In a well-designed agentic checkout you stay the merchant of record. The Agentic Commerce Protocol is explicit that the merchant remains the seller: the AI surface presents your product and takes the order, but the sale is still between you and the shopper. That is the difference between letting an agent sell your product and letting a platform resell it. It is the single most important thing to confirm before you enable agent checkout anywhere.
What is Google's AP2 (Agent Payments Protocol)?
AP2, the Agent Payments Protocol, is an open specification Google announced on September 16, 2025 with more than 60 payment and commerce partners, including Mastercard, PayPal, and American Express. It solves the trust problem underneath agent payments: how does a merchant know an agent is authorized to spend a shopper's money? AP2's answer is signed mandates. The shopper's device produces cryptographically signed proof of intent (an Intent Mandate for what they asked for and a Cart Mandate for the exact basket and price), so the merchant and the rail can verify the purchase was genuinely authorized. AP2 sits underneath the commerce protocols as the payment-authorization layer, not as a competitor to them.
How does an agent pay without seeing my customer's card details?
Through scoped, single-use payment credentials rather than raw card numbers. Stripe's Shared Payment Token, part of its Agentic Commerce Suite, issues a token that is limited to one merchant and one specific basket, so the agent can complete that purchase without ever handling the underlying card. The card networks do the same thing their own way: Visa Intelligent Commerce and Mastercard Agent Pay use tokenized credentials with agent-specific controls. The principle is consistent across the ecosystem: the agent gets permission to make one payment, not a copy of the customer's card, which limits the blast radius if anything goes wrong.
Sources & further reading: Agentic Commerce Protocol, ACP on GitHub, Google: Universal Commerce Protocol, Google Cloud: Agent Payments Protocol (AP2), and Stripe: Agentic Commerce Suite. Partner counts and launch dates are as reported by the primary sources at announcement; the in-chat checkout economics remain in flux and the 4% figure is attributed by The Information to Shopify, not published by OpenAI. Treat commercial terms as directional and confirm current details with your platform and payment provider.