What the Agentic Commerce Protocol actually standardizes
Before ACP, an AI agent that wanted to buy something had to be integrated store by store, because every merchant exposed a different catalog format and a different checkout. ACP replaces that with one interaction model between three parties: the buyer, the agent acting for them, and the business selling. The current specification, dated 2026-04-17, defines five composable building blocks. Agentic checkout creates, updates and completes a checkout session with cart contents, fulfillment options and payment. Cart and feed let an agent browse a product catalog and assemble an order before checkout. Delegate payment passes a scoped payment token between the buyer, the agent and the business through a payment handler. Delegate authentication uses OAuth 2.0 so an agent can act on a signed-in buyer behalf. Orders and webhooks carry lifecycle updates back: confirmation, shipping, delivery, refunds.
How agentic checkout works, step by step
A shopper asks an agent for something. The agent reads the merchant product feed, finds matching items and opens a checkout session against the merchant ACP endpoint. It adds line items, gets back real shipping options, taxes and totals, and shows the shopper a confirmation surface. When the shopper approves, a delegated payment token is created and handed to the merchant, who charges it through their own processor and their own merchant account. The order is created on the merchant side, and webhooks push status changes back to the agent so the shopper can ask about the package later in the same conversation. The merchant keeps the customer relationship, the payment processing and the fulfillment obligation. The agent is the storefront, not the seller of record.
Delegated payment tokens: the part that matters for risk
The most important design choice in ACP is that the agent never holds raw card data. Instead, a payment handler mints a delegated token that is scoped to a specific purchase and passed to the specific merchant completing it. If that token leaks it is close to useless, because it is bound to one transaction context rather than being a reusable credential. This is the same instinct behind scoped virtual cards, and it is why agentic checkout is meaningfully safer than the alternative people reach for first, which is pasting a corporate card number into an agent config. What the token does not do is decide whether the purchase is a good idea, whether it fits a budget, or whether the agent was manipulated into making it.
ACP, AP2 and x402 solve different layers
These three standards get compared as rivals and they are not. ACP covers checkout: the commercial conversation between an agent and a merchant. AP2, the Agent Payments Protocol led by Google, covers authorization, using cryptographically signed mandates to prove an agent had real user permission to buy within stated limits. x402, introduced by Coinbase, covers settlement, reviving the HTTP 402 status code so machines can pay inline for a resource, typically in stablecoins and typically for tiny amounts. A serious agent payments stack will touch more than one of them, which is why our breakdown of AP2 vs ACP vs x402 treats them as a layer cake rather than a bake-off. A fourth standard now sits above all three: the Universal Commerce Protocol, co-developed by Google and Shopify and announced in January 2026, which covers catalog search, cart, checkout, and order lifecycle in one merchant-hosted specification. UCP is the closest thing ACP has to a direct rival, and most US merchants will end up implementing both, because ACP is how you reach ChatGPT and UCP is how you reach AI Mode in Google Search and the Gemini app.
What a merchant has to implement to support ACP
Three pieces have to exist: a product feed the agent can read, checkout endpoints that follow the ACP specification, and a payment integration that accepts a delegated token. How much work that is depends entirely on your stack. Shopify merchants enable a ChatGPT sales channel from the admin with no code. Stripe and PayPal both ship ACP server support, which covers a large share of US sellers. Everyone else implements the REST endpoints from the open specification on GitHub, or exposes the same capabilities as an MCP server, which the 2026-04-17 release added as an alternative to REST. The card networks are moving in too: both Visa Intelligent Commerce and Mastercard Agent Pay can route ACP-initiated payments with their own tokenized credentials. Instant Checkout in ChatGPT currently requires a US merchant and a US buyer, and OpenAI has publicly confirmed a 4 percent fee on completed Instant Checkout orders, charged to the merchant on top of normal processing costs. We broke the setup and the economics down in our guide to ChatGPT Instant Checkout for merchants, and the wider channel, catalog and fraud work in our readiness guide to agentic commerce for merchants.
The gap ACP leaves open: buy-side spend governance
ACP is written from the merchant point of view. It answers how do I let an agent buy from me. If you are the company whose agents are doing the buying, none of your questions are answered by it. Which agent is allowed to spend, up to what amount, with which counterparties, how often, and who signs off above a threshold are all buy-side decisions that live outside the protocol. That gap gets expensive fast, because an agent that retries a failed order, misreads a quantity, or gets steered by prompt injection will happily complete a perfectly protocol-compliant purchase you never wanted. It is the same problem whether the buyer is a shopping agent filling a cart or a procurement agent renewing a contract. Standards make the transaction possible. Policy makes it accountable.
How Agentspay governs ACP purchases
Agentspay is the rail-neutral control plane that sits in front of whatever standard moves the money. Every agent gets its own funded wallet with hard limits rather than access to a shared corporate card. Each intended purchase is checked against policy before a credential exists: per-transaction ceiling, budget over a window, merchant allowlist, velocity rules. Spend above your threshold pauses for a human approval instead of going through. What the agent receives is a scoped virtual card or a delegated credential valid for that one purchase, and every decision lands in an immutable audit trail tied to the agent, its human owner, the intent and the policy that allowed it. Adopt ACP for checkout, AP2 for mandates, x402 for machine settlement, and keep one place that never moves money without policy.