What is Visa Intelligent Commerce?
Visa describes it on its own product page as a strategic portfolio for the age of AI agents, covering agents, issuers, merchants and developers. The word portfolio is doing real work in that sentence and it is the thing most write-ups get wrong. Visa Intelligent Commerce is not one API you integrate. It is a set of capabilities that arrived at different times, sit in different places, and are aimed at different parties: credential issuance and controls for issuers and consumers, an acceptance integration for merchants, an identity protocol for anyone receiving agent traffic, and developer tooling that wraps the lot. If you are evaluating VIC, the first useful question is not "how do I integrate it" but "which of the four am I actually the buyer of", because the answers are genuinely different pieces of work.
How does Visa Intelligent Commerce work?
The model is delegation on top of tokenization, and it runs in four steps. A consumer enrolls a card and gives explicit consent for an agent to use it, including spending limits and the conditions the agent must respect. Visa binds that consent to a device and authenticates it using standards it already runs, specifically FIDO and Visa Payment Passkeys, so the grant is tied to a verified person rather than to a string in a config file. The agent then receives a Visa-tokenized credential that is specific to a merchant and constrained by the consumer’s mandate, so a token minted for one airline and one trip window is worthless anywhere else. At checkout the merchant receives that token like any other card-not-present transaction, with Visa handling agent verification at the network level. The important structural point is where each control lives: the limits belong to the consumer’s mandate and the issuer, and the verification belongs to the network. Neither of those is your finance team.
What is the Visa Trusted Agent Protocol?
The Trusted Agent Protocol, or TAP, is the piece that deserves far more attention than it gets. Visa introduced it on October 14, 2025, co-developed with Cloudflare, and published a reference implementation at github.com/visa/trusted-agent-protocol. It solves a problem that predates payment: a merchant receiving automated traffic cannot tell a legitimate shopping agent from a scraper or a card tester, so the safe default has been to block bots and lose the good ones with the bad. TAP adds cryptographic agent identity to the ordinary HTTPS request using the RFC 9421 HTTP Message Signatures standard, aligned with the Web Bot Auth work. The agent signs the request; the merchant or its CDN verifies the signature against a public key registry, which is the same verification Cloudflare and AWS WAF already perform for signed bots. Visa framed the goal as making sellers able to trust AI agents as much as they trust their best customers, and the launch list was broad for a network-led spec: Adyen, Ant International, Checkout.com, Coinbase, Cybersource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe and Worldpay.
What is the difference between agent-browser-auth and agent-payer-auth?
This is the most consequential detail in the whole specification and it is almost never written about. TAP carries the agent’s intent in the tag field of the Signature-Input header, and there are two values. agent-browser-auth means the agent is reading: browsing product pages, comparing prices, assembling a cart, not committing to anything. agent-payer-auth means the consumer has authorized this agent to charge a specific amount at this merchant, and the request should be treated as a binding payment instruction. The signature itself carries @authority and @path, created and expires timestamps, a keyid, an alg, a nonce and that tag, which is what makes it non-replayable and locked to one merchant and one operation. Read that list again from the buying side. TAP tells the seller, with cryptographic certainty, that an agent has authority to pay. It tells the company that owns the agent nothing at all.
What is Visa Intelligent Commerce Connect?
Intelligent Commerce Connect is the acceptance-side expansion Visa announced in June 2026, delivered through the Visa Acceptance Platform. The pitch is one integration instead of many: merchants, agent builders and payment enablers plug in once and get payment initiation, tokenization, spend controls and authentication, with support for payments initiated through several competing agent protocols rather than only Visa’s own. That protocol breadth is the genuine differentiator and it is a strategic bet worth naming. Where some players are trying to make their standard the standard, Visa is trying to make the standards question irrelevant to the payment, so a merchant is not stranded if the protocol it picked loses. If you are choosing between an integration path that assumes one protocol wins and one that does not, that difference matters more than any feature list.
Is there a Visa Intelligent Commerce API?
Yes, and there are now two ways to reach it. The direct route is the VIC APIs on the Visa Developer Platform and the Visa Acceptance Developer Portal, covering card enrollment on behalf of a consumer, consent capture, spending limits, mandate management and device binding. The newer route is the Visa MCP Server, which Visa announced in September 2025 as a secure integration layer letting AI agents and large language models connect directly to Visa Intelligent Commerce APIs. Built on top of it is the Visa Acceptance Agent Toolkit, which lets developers and non-technical users trigger Visa Acceptance API actions such as invoicing and Pay By Link with plain-language commands and no code. Both shipped in pilot, initially as a self-hosted npm package for JavaScript, with Visa publishing starter code at github.com/visa/mcp. If you have integrated payments through the Model Context Protocol before, the shape will be familiar.
Is Visa agentic commerce live yet, or still a pilot?
It is real, it is small, and Visa has been unusually specific about the numbers. On December 18, 2025 Visa announced it had completed hundreds of secure agent-initiated transactions with ecosystem partners, and named which ones: Skyfire with Consumer Reports product recommendations, Nekuda with the Gensmo fashion app and a Price.com integration, PayOS with BeyondStyle and Jomashop, and Ramp on the B2B side. Visa put more than 100 partners in the collaboration, more than 30 building in the VIC sandbox, and more than 20 agents or enablers integrating. It also cited a 4,700% surge in AI-driven traffic to US retail sites over the preceding year and said 47% of US shoppers were already using AI for shopping tasks. Hundreds of transactions is a pilot, not a channel. But the direction of travel is not in doubt, and Visa’s own framing was that 2026 is when agents stop assisting a purchase and start completing it.
Visa Intelligent Commerce versus Mastercard Agent Pay
They rhyme more than they differ. Both networks launched their agentic programs in April 2025, both replace raw card numbers with scoped agentic tokens, and both shipped machine-to-machine capabilities in June 2026. The emphasis differs: Visa is selling one integration that speaks many protocols and reaches any Visa-accepting merchant, while Mastercard Agent Pay is selling agent-to-agent settlement across cards, bank accounts and stablecoins with a wide partner set. Neither is a walled garden and both intend to interoperate with the emerging protocol stack rather than replace it. If you are picking between them, the full breakdown lives on our Visa Intelligent Commerce vs Mastercard Agent Pay comparison, including settlement rails, first issuing banks and where each one stops.
What Visa Intelligent Commerce does not do
Everything Visa has built here points at the transaction and at the seller. That is not an oversight, it is the correct scope for a card network, but it leaves a specific hole for any company whose agents are the ones spending. A merchant-scoped token caps one credential at one seller. TAP proves one agent’s authority for one request. A consumer mandate constrains one person’s card. Not one of those knows that the agent presenting the token has already spent eleven thousand dollars this month across nine merchants, because nothing in the design keeps a running total across agents, merchants and rails. Nor does any of it pause a purchase for a human when an agent tries to renew a contract, buy compute far outside its normal pattern, or loops on a retry. Visa says as much implicitly by where it puts the controls: the spending limits it advertises belong to the consumer’s mandate and the issuer, not to your finance team’s policy. This is the same structural gap that sits in Google’s AP2, in ACP and in x402, and it exists because a rail is scoped to authorize transactions rather than to govern budgets.
Where a control plane fits alongside Visa Intelligent Commerce
None of this is an argument against using Visa. If your agents buy from ordinary merchants, the card rail is the one that already reaches them, and a scoped agentic token is a decisive upgrade on the shared corporate card most teams are quietly using today. The missing layer sits above the rail rather than beside it. AgentsPay is rail-neutral, so the policy you write does not change when the payment moves between Visa, Mastercard or a stablecoin. Each agent gets its own funded wallet with a hard limit, which makes overspending structurally impossible rather than merely discouraged. Every intended purchase is checked against policy before a credential exists: per-transaction ceiling, budget over a window, merchant allowlist, velocity rules. Spend above your threshold pauses for human approval instead of completing and being discovered later. The agent then receives a scoped virtual card good for that one purchase, riding Visa rails underneath. And every decision, the policy that allowed it, the agent that asked and the person who approved it, lands in one immutable audit trail. Visa decides whether the transaction is authentic. The control plane decides whether it should have happened.
What to watch next
Three things worth tracking. Whether TAP adoption spreads beyond the launch partners, because an agent-identity protocol is only useful when enough merchants verify it, and Cloudflare sitting in front of a large share of the web makes that plausible in a way a network-only spec would not be. Whether Visa’s protocol neutrality in Intelligent Commerce Connect holds once one standard pulls ahead on volume. And whether anything in the VIC roadmap ever crosses to the buying side, because as of August 2026 every control Visa has shipped belongs to the consumer, the issuer or the merchant, and none of it belongs to the business whose agent fleet is generating the spend. We keep this page current as those move. For a wider view of the vendors in this space, see our comparison of AI agent payment platforms.