Agentspay

Explainer

Agentic Checkout: How It Works, the ACP and UCP Protocols, and How Merchants Accept It

Nearly every guide to agentic checkout is written for the merchant who wants to receive these orders. Far fewer are written for the company whose agents are placing them, which is odd, because agentic checkout quietly removes the one screen where spending used to get a second look.

Agent Payments Console

Pick an agent

Payment intent

intent:

Policy evaluation

Human approval required

This spend is over your approval threshold. Approve it to issue a scoped card, or deny it.

Scoped virtual card issued

Agentspay

single-use

Wallet budget

spent of

Audit trail

In short

Agentic checkout is the step where an AI agent completes a purchase on a buyer's behalf, handling payment, shipping, tax and order confirmation without sending the person to the merchant's website. It normally runs over one of two open protocols: the Agentic Commerce Protocol, released by OpenAI and Stripe under Apache 2.0 on September 29, 2025 and used by ChatGPT Instant Checkout, or Google's Universal Commerce Protocol, announced at NRF on January 11, 2026. In both designs the merchant stays the seller of record, creates the checkout session and captures payment, while the agent orchestrates discovery, comparison and the order itself. For merchants the work is making a catalog and checkout that an agent can use without a browser. For the businesses buying this way, the change is subtler and more urgent: the checkout page was the last place a human saw the total before money moved, and once an agent completes the purchase, that control has to live somewhere else.

What is agentic checkout?

Agentic checkout is the moment an autonomous AI agent finishes a purchase for someone. The agent assembles the order, applies shipping and tax, submits payment and returns a confirmation, all without the buyer clicking through a merchant's checkout flow. The distinction worth holding on to is that agentic checkout is the settlement step, not the whole shopping journey. The broader pattern of an agent searching, comparing and deciding is agentic commerce; agentic checkout is the narrow, technically demanding part at the end where money actually changes hands. It matters because the old model assumed a human was present at exactly that moment. Card networks, fraud systems, merchant terms and internal expense policy were all written around a person reading a total and pressing a button. Remove the person and a surprising number of quiet assumptions stop holding.

How does agentic checkout work?

Most agentic purchases run through four stages. Discovery: the agent searches across merchants, usually against structured product feeds rather than by reading web pages. Evaluation: it compares candidates on price, availability, delivery and whatever constraints the buyer stated. Checkout: it creates a checkout session with the chosen merchant, and the merchant returns the real total including shipping and tax. Payment and confirmation: a payment credential is passed, typically as a network token rather than a raw card number, the merchant captures payment and returns an order confirmation the agent relays back. The important structural point is that the merchant is doing the merchant things throughout. The agent is not scraping a storefront or filling in a form; it is calling documented endpoints, which is why the protocols below exist at all.

What are the agentic checkout protocols?

Two open standards dominate, and they solve overlapping problems from different directions. The Agentic Commerce Protocol (ACP) was co-developed by OpenAI and Stripe and released under Apache 2.0 on September 29, 2025, with the two companies as founding maintainers and date-based versioning. It debuted alongside ChatGPT Instant Checkout, which went live with Etsy and then added Shopify brands. ACP is checkout-first: it defines how an agent creates and completes a checkout session against a merchant. Google's Universal Commerce Protocol (UCP) was announced by Sundar Pichai at the NRF keynote on January 11, 2026, is also Apache-2.0, and is capability-first: a merchant publishes a profile at /.well-known/ucp describing what it supports, whether that is checkout, product search or returns, and agents identify themselves with a UCP-Agent header. We cover each in depth in the Agentic Commerce Protocol explainer and the Universal Commerce Protocol explainer. The table below is the practical comparison.

Do merchants have to choose between ACP and UCP?

No, and most serious commerce teams are planning to support both. They are not competing payment rails; they are competing interface conventions in front of the same store and the same processor. Supporting both is closer to supporting two API clients than to signing with two acquirers. The reason it feels like a choice is distribution: ACP is where ChatGPT traffic arrives and UCP is where Google's surfaces arrive, so the sequencing question is really about which assistant your customers already use. What you should not do is treat either as a reason to rebuild your checkout. Both designs deliberately leave the merchant as the seller of record, capturing payment through the processor already in place. If a vendor tells you agentic checkout requires replacing your payment stack, that is a product pitch rather than a protocol requirement.

How do merchants accept agentic checkout?

The work is less about payments than about making a store legible to software. In rough order of effort: publish a clean, current product feed, because an agent that cannot see accurate price, availability and variants will not select you, and a stale feed produces failed orders rather than lost impressions. Expose checkout as an API, so a session can be created, priced with real shipping and tax, and completed without a browser. Remove the human-only gates on that path: CAPTCHAs, interstitials and bot rules that assume a browser will decline legitimate agent orders. Accept tokenized agent payment credentials through your existing processor. Decide your policy on returns and disputes before volume arrives, because agent orders concentrate in exactly the categories where sizing and fit go wrong. The honest sequencing advice is to fix the feed first. Merchants who skip that step and rush the checkout integration end up with an endpoint that works perfectly and never gets called. If you sell on Shopify, most of this is already done for you and the remaining work is data quality, which we walk through in the Shopify agentic commerce guide. If you are on Adyen, its Agentic Feed, Cart and Payments layers do the same job for enterprise merchants, and we cost the whole stack out in Adyen agentic commerce pricing.

Who is the seller of record in an agentic checkout?

The merchant, in both ACP and UCP as designed. The assistant is an interface, not a reseller. The merchant sets the price, captures the payment, fulfills the order and owns the customer relationship afterwards, including returns and support. This is deliberate, because the alternative would drag assistants into merchant of record obligations across every tax jurisdiction their users live in. It has a practical consequence worth planning for: the customer service conversation about an agent-placed order still lands with you, and the buyer may have never seen your site. Order confirmations, return instructions and support contact details need to make sense to somebody encountering your brand for the first time in a shipping notification.

How does payment actually work in agentic checkout?

Payment credentials are passed as tokens scoped to the transaction rather than as raw card numbers held by an assistant. The card networks have built for this directly: Visa Intelligent Commerce, announced in April 2025 and expanded in June 2026 with Intelligent Commerce Connect, issues merchant-specific scoped tokens, and Mastercard Agent Pay uses Agentic Tokens extending MDES, with Citi and US Bank among the first issuers. The design goal is that a compromised or misbehaving agent holds a credential that is useless outside the transaction it was scoped to. Stablecoin settlement is the other live path, more common when the buyer is a machine paying for a machine service than when the buyer is a consumer buying a sweater. We compare the two in stablecoins versus virtual cards for agents. Either way the merchant's processor sees a payment it can capture, which is why merchants generally do not need a new acquirer to participate.

What agentic checkout removes on the buyer side

Here is the part most coverage skips, and it is the part that costs money. The checkout page was never only a payment interface. For most companies it was, informally, the last budget control: a human saw a total, noticed it was higher than expected, and stopped. Agentic checkout is specifically designed to remove that screen. When your procurement agent, travel agent or ad-buying agent completes a purchase, nobody reads the total. That is the entire point, and it is also the entire problem. The protocols do not solve it, because they are merchant-side standards. ACP and UCP describe how an order gets placed, not whether your company wanted to spend that money. Neither carries a buyer budget, and the scoped payment tokens above cap a single transaction rather than a cumulative total. An agent can therefore place forty individually reasonable orders that add up to something nobody would have approved. The control has to move to the payer, before the agent ever reaches a merchant.

Putting spend controls back where the checkout page used to be

If a human is no longer reading the total, the decision has to be made by policy in advance, and it has to be enforced at the instrument rather than in the prompt. In practice that means four things. A funded wallet with a hard cap, so the maximum loss from any failure mode is a number you chose. A merchant and category allowlist, so an agent that finds a cheaper unapproved supplier simply fails the authorization. An approval threshold, above which the transaction pauses and a named person gets a one-tap approve or deny, which restores the human check exactly where it is worth its latency and nowhere else. And an audit trail tying each authorization to the agent, the human owner, the task and the policy verdict, because the reconciliation problem is worse when there is no browser session and no expense report to reconstruct from. That is what Agentspay does across card rails and stablecoins from one control plane, and you can see the same surfaces on agent spend controls and human approvals. The console at the top of this page runs the same policy engine.

Chargebacks, returns and who is liable

Liability sits with the human or company that owns the agent, because no jurisdiction treats an agent as a legal person capable of holding an obligation. Authority flows from whoever funded the instrument and set the policy. For merchants the practical exposure is disputes: an agent-placed order is easier for a consumer to disown than one they clicked through themselves, and "my assistant bought the wrong thing" is a conversation your support team will have. The mitigations are unglamorous and effective. Keep the confirmation the agent received, including the exact price and terms presented at session creation. Make returns easy enough that a dispute is the worse option for the buyer. On the buying side, prefer card rails over stablecoins for anything you might want to reverse, since card payments can be disputed and on-chain settlement generally cannot. We go deeper in who is liable when an AI agent buys the wrong thing.

Whatever standard moves the money, Agentspay is the rail-neutral control plane that keeps it governed. See how it works and the control surfaces that enforce policy, approvals, and audit on every transaction.

The protocols

ACP and UCP compared for agentic checkout

Both are Apache-2.0 open standards that leave the merchant as seller of record. They differ in origin, scope and which assistant surface they bring.

Agentic Commerce Protocol (ACP) Universal Commerce Protocol (UCP)
Created by OpenAI and Stripe, founding maintainers Google, announced by Sundar Pichai at NRF
Released September 29, 2025, Apache-2.0 January 11, 2026, Apache-2.0
Primary surface ChatGPT Instant Checkout Google assistant and shopping surfaces
Design emphasis Checkout-first: create and complete a session Capability-first: publish what the merchant supports
Merchant discovery Integration and catalog submission Profile at /.well-known/ucp, UCP-Agent header
Seller of record Merchant Merchant
Payment handling Tokenized credential to the merchant processor Tokenized credential to the merchant processor
Carries a buyer budget No, priced per checkout session No, priced per checkout session

Both sides

What changes for sellers, and what changes for buyers

Merchant readiness is well covered elsewhere. The right-hand column is the work that falls on the company whose agents are doing the purchasing.

Area If you are accepting agent orders If your agents are placing them
First job Publish an accurate, current product feed Give each agent a capped, funded wallet
Interface Expose checkout as an API, no browser required Enforce policy at the instrument, not in the prompt
Bot rules Stop blocking legitimate agents at the edge Allowlist approved merchants and categories
Human step Removed from your checkout by design Reintroduced as an approval threshold you set
Payment Accept tokenized agent credentials via your processor Choose a rail you can reverse if you may need to
Records Retain the confirmation and terms presented Tie every authorization to agent, owner, task and policy
Biggest risk A stale feed, so agents never select you Many reasonable orders adding up to an unapproved total

Frequently asked

Questions people ask about Agentic Checkout

What is agentic checkout?

Agentic checkout is the step where an AI agent completes a purchase for a buyer, handling payment, shipping, tax and order confirmation without redirecting the person to the merchant's website. It is the settlement part of agentic commerce, the narrow moment where money actually moves.

How does agentic checkout work?

In four stages. The agent discovers products across merchant feeds, evaluates them against the buyer's constraints, creates a checkout session with the chosen merchant to get a real total with shipping and tax, then submits a tokenized payment credential and relays the confirmation back to the buyer.

What is the difference between agentic commerce and agentic checkout?

Agentic commerce is the whole journey: an agent searching, comparing and deciding on a buyer's behalf. Agentic checkout is only the final step where the order is placed and paid. Most of the technical standards work, and most of the risk, concentrates in that last step.

What protocols are used for agentic checkout?

Two open standards dominate. The Agentic Commerce Protocol from OpenAI and Stripe, released Apache-2.0 on September 29, 2025, powers ChatGPT Instant Checkout. Google's Universal Commerce Protocol, announced at NRF on January 11, 2026, has merchants publish a capability profile agents read before transacting.

How do I make my checkout AI-agent-ready?

Publish an accurate product feed, expose checkout as an API that returns real shipping and tax, remove CAPTCHAs and bot rules from that path, and accept tokenized agent payment credentials through your existing processor. Fix the feed first: an agent that cannot see accurate stock will not select you.

Who is the seller of record in an agentic checkout?

The merchant, under both ACP and UCP. The assistant acts as an interface, not a reseller. The merchant prices the order, captures payment, fulfills it and handles returns and support afterwards, even though the buyer may never have visited the merchant's website.

Is agentic checkout safe?

The payment layer is reasonably well designed: credentials are passed as tokens scoped to a single transaction, so a compromised agent holds something useless elsewhere. The weaker point is budget. Scoped tokens cap one transaction, not a cumulative total, so many individually valid purchases can still add up to an unapproved amount.

Can I set a spending limit on an AI agent that checks out for me?

Not through the checkout protocols, which are merchant-side and carry no buyer budget. Limits have to be enforced at the payment instrument before the agent reaches a merchant: a capped wallet, a merchant allowlist, and an approval threshold above which a person confirms. Prompt instructions are not an enforcement mechanism.

Do I need a new payment processor for agentic checkout?

Usually not. Both protocols leave the merchant capturing payment through the processor already in place, and agent credentials arrive as tokens your acquirer can process. The integration work is in the catalog and checkout API rather than in the payment relationship.

Who is liable if an AI agent buys the wrong thing?

The human or company that owns the agent, since no jurisdiction treats an agent as a legal person. Authority flows from whoever funded the instrument and set the policy, which is a practical reason to record which policy allowed each purchase rather than only that the purchase happened.

Keep reading

More explainers

ServiceNow AI Control Tower

ServiceNow AI Control Tower

ServiceNow AI Control Tower is the most complete agent inventory and risk console a large US enterprise can buy, and it now reaches across AWS, Google Cloud and Azure. We read the schema ServiceNow ships to developers to answer the one question the rollout meeting always ends on: can it stop an agent from spending money? It cannot, and the reason is written into the data model.

Read

Gemini Enterprise

Gemini Enterprise

Google did something in August 2026 that the other agent platforms have not done: it shipped a hard monthly spend cap that genuinely stops usage instead of emailing you about it. That deserves credit, and it also moves the interesting question one step along. A cap that stops something is only as useful as the thing it is scoped to, so we went and measured what Google can actually point that cap at, in the API model Google publishes for anyone to read.

Read

Salesforce Agentforce

Salesforce Agentforce

Agentforce is the largest agent platform any US enterprise is likely to already own, and it moved to consumption billing, which means the meter now runs on what your agents do rather than on how many seats you bought. That raises a finance question the rollout deck rarely answers: when an Agentforce agent is loose in production, what actually stops it spending. We went and measured the answer in Salesforce own published object model rather than guessing at it.

Read

AWS AgentCore

AWS AgentCore

Amazon shipped the missing piece in August 2026. Bedrock AgentCore Payments went generally available, and it is a real payments product: an agent can now hold a wallet, meet an HTTP 402, pay, and carry on reasoning without a human in the loop. So the question a platform lead has to answer stopped being whether AWS gives agents money and became a narrower, more awkward one: how much of a spend policy did AWS actually ship? We went and measured it, property by property, in the API model AWS publishes.

Read

Microsoft Agent 365

Microsoft Agent 365

Microsoft shipped a control plane for AI agents, and it is a good one. It gives every agent an identity, a registry entry, an owner, a sponsor and a Conditional Access policy. Then somebody in finance asks the obvious follow-up question: fine, but what stops the agent from spending money? This page answers what Agent 365 costs, what it governs, and what we measured when we went looking for a dollar amount anywhere in Microsoft's agent governance surface.

Read

QuickBooks MCP Server

QuickBooks MCP server

Connecting an accounting system to an AI assistant is now a ten minute job. Deciding what that assistant is allowed to do once it is connected is the part nobody writes about, and it is the part your controller will ask about first. This page compares what the official QuickBooks, NetSuite and Xero MCP servers actually hand a model, measured rather than summarized from marketing pages.

Read

Payment MCP Servers

payment MCP servers

Every large payment company shipped an MCP server in the last eighteen months, and almost every write-up of them is a setup tutorial. The setup is the easy part. The question worth answering before you connect one to a production account is narrower and much less comfortable: what, exactly, can the model on the other end of that connection do to your money?

Read

PayPal Agentic Commerce

PayPal Agentic Commerce

PayPal made a bet that most merchants would rather not implement a commerce protocol at all. Where Stripe and OpenAI shipped a spec for you to build against, PayPal shipped two products that sit on top of the checkout you already have, and then bought a company to make the catalog half work. That choice is the whole story: it explains why Agent Ready needs almost no engineering from you, why there is nothing for an agent to discover about your store on the open web, and why the thing PayPal will not do for you is the thing that gets expensive later.

Read

Shopify Agentic Commerce

Shopify Agentic Commerce

Shopify switched agentic commerce on by default, so your store is probably already selling to AI assistants whether or not anyone on your team configured it. Instead of restating the announcement, we checked something you can check too: on September 2, 2026 we requested the machine-readable capability file that Shopify publishes for real storefronts, on fourteen well-known US brand domains, and read what it exposes to an agent. Eleven answered correctly. The three that did not share one trait, and it is quietly costing them agent traffic.

Read

Web Bot Auth

Web Bot Auth

Web Bot Auth is the reason your agent either gets served or gets throttled with the scrapers. Almost everything written about it repeats the same architecture diagram, so we did something different: on September 1, 2026 we fetched the published key directories of more than twenty major AI operators and infrastructure vendors to see who is genuinely signing their traffic. Four were. The results are in the first table.

Read

Tempo Blockchain

the Tempo blockchain

Tempo is the payments chain Stripe and Paradigm built, and it shipped with a protocol that lets software pay for things on its own. It settles machine payments in under a second. It has nothing at all to say about whether your agent should have paid.

Read

AI Agent Governance

AI agent governance

Every agentic AI governance framework published so far governs the same four things: identity, tools, data and prompts. Not one of them carries a budget. Here is what the real frameworks say, which guardrails actually bind at runtime, and what to do about the last mile none of them reach.

Read

A2A Protocol

A2A Protocol

Most explanations of the A2A protocol stop at the sentence that agents can now talk to each other. That was true in April 2025 and it is no longer the interesting part. A2A shipped version 1.0 in April 2026 under Linux Foundation governance, it runs in production inside Azure AI Foundry and Amazon Bedrock AgentCore, and the questions engineers actually get stuck on are narrower: what an Agent Card commits you to, when to reach for MCP instead, and what happens the first time one of your agents has to pay another one for the work. That last question has a specific answer, and it is not in the core spec.

Read

Mastercard Agent Pay

Mastercard Agent Pay

Nearly every article about Mastercard Agent Pay is a retelling of one press release from April 2025, the one where Mastercard said AI agents would be able to shop with Agentic Tokens and named Microsoft as the first platform. That was sixteen months ago, and four more things have shipped since. Reading only the launch coverage leaves you with roughly a quarter of the picture, and the missing three quarters are the parts that decide whether you can actually put this into production.

Read

Visa Intelligent Commerce

Visa Intelligent Commerce

Almost everything written about Visa Intelligent Commerce is a retelling of the April 2025 announcement, when Visa said AI agents would be able to pay with a Visa credential. Three more things have shipped since, including an open agent-identity protocol built with Cloudflare that most coverage does not mention at all. This page is the current version, checked against Visa’s own developer documentation and newsroom in August 2026.

Read

Stripe agentic commerce

Stripe agentic commerce

Most writing about Stripe and agentic commerce is still a retelling of the September 2025 launch week, when Stripe and OpenAI shipped Instant Checkout and published the Agentic Commerce Protocol together. Stripe has built a good deal more since then, and some of it points in a direction the launch coverage never anticipated. This page is the current version, checked against Stripe’s own documentation in August 2026.

Read

ChatGPT Instant Checkout

ChatGPT Instant Checkout

Almost every guide to ChatGPT Instant Checkout still reads like it was written the week it launched, walking merchants through how to apply and what the fee will be. OpenAI changed course in March 2026. Here is the accurate version: what Instant Checkout was, what the numbers actually looked like, what replaced it, and which parts of the stack are still very much alive.

Read

Google AP2

Google AP2

Most guides to Google AP2 still describe an Intent Mandate and a Cart Mandate, because most of them are rewrites of the September 2025 launch post. The specification moved. Here is what the Agent Payments Protocol actually defines today, and the one question it deliberately does not answer.

Read

Human in the loop AI

Human in the Loop AI

Every guide to human in the loop AI describes the same shape: the agent pauses, a person decides, the agent continues. The shape is right. What almost none of them ask is a harder question, which is where the pause is enforced, because a pause written into the agent's own code is a pause the agent is trusted to honor.

Read

AI agent cost

AI Agent Cost

Every cost guide for AI agents answers the same two questions: what does it cost to build, and what does it cost to run. Both are answerable, and both are on somebody's invoice. The third question is the one that ends up in a variance report, because the agent also spends your money, and nobody sends you a bill for that.

Read

API monetization

API Monetization

Most guides to API monetization argue about which pricing model wins. The harder question in 2026 is who is calling. An API priced for a signed-up developer with a key behaves very differently when the caller is an agent that showed up once, wants one record, and has no account.

Read

x402 protocol

x402 Protocol

x402 took the one HTTP status code the web never used and turned it into a payment rail machines can drive. The protocol is elegant and genuinely small. The part it deliberately leaves to you is the budget.

Read

AI procurement agents

AI Procurement Agents

Every major procurement suite shipped agents during 2026. Almost none of them answer the question your controller will ask first, which is what happens when the agent is wrong about a purchase and the money has already moved.

Read

Agentic payments

Agentic Payments

Agentic payments move money with no human at the checkout. The rails to do it all shipped during 2026. The part most teams have not solved is deciding, before the money moves, whether the agent was allowed to spend it.

Read

AI agent monetization

AI Agent Monetization

Every AI agent company is rewriting its price list. The models that survive are metered. The ones that quietly fail are the ones where nobody measured what a single task costs to serve.

Read

Agent payment platforms

AI Agent Payment Platforms

Five different kinds of product now call themselves an AI agent payment platform, and they solve five different problems. Picking the wrong category is the expensive mistake, not picking the wrong vendor inside a category.

Read

Universal Commerce Protocol

the Universal Commerce Protocol (UCP)

Google and Shopify shipped UCP as an open standard so an AI agent can check out at any merchant that supports it. Here is what the specification actually defines, where it is live for US buyers, and the one thing it deliberately leaves to you.

Read

MCP Payments

MCP Payments

MCP payments are how an AI agent discovers a payment tool and calls it to move money. The catch: the Model Context Protocol carries the tool call, not the spending decision, so nothing in the stack asks whether the purchase should have happened.

Read

Visa Intelligent Commerce vs Mastercard Agent Pay

Visa Intelligent Commerce vs Mastercard Agent Pay

Visa Intelligent Commerce and Mastercard Agent Pay are the two big card networks racing to let AI agents pay. They take different routes to the same idea, and neither one decides whether a given purchase should have happened.

Read

Agentic Commerce Protocol

the Agentic Commerce Protocol

ACP is the open standard behind agentic checkout in ChatGPT. It tells a merchant how to sell to an AI agent. It says nothing about whether your agent should have made the purchase.

Read

AP2 vs ACP vs x402

AP2 vs ACP vs x402

AP2, ACP, and x402 are the three standards shaping how AI agents pay. They solve different layers of the problem, and most real systems will touch more than one.

Read

Machine payments protocol

Machine payments protocol

As software starts paying software, machine payments protocols define how value moves without a human at the keyboard. The harder question is how to keep that spending governed.

Read

Know Your Agent (KYA)

Know Your Agent

KYA, or Know Your Agent, extends the idea of customer due diligence to autonomous software. When an agent spends, you need to know which agent, on whose authority, and under what limits.

Read

Keep agent spending governed

Add policy, hard limits, human approval, and an immutable audit trail across any protocol or rail. Start in the sandbox today.

Never moves money without policy