Agentic Payment Protocols, Explained

Why payment rails matter to selection

Before an AI shopping agent can buy anything on your behalf, it has to complete a payment it is authorized to make, and prove, after the fact, that it was allowed to. That is the job of the agentic payment protocols: they standardize how an agent is trusted, how its intent is captured, and how a card or account credential is scoped to a single purchase. They sit underneath the discovery-and-checkout protocols like UCP and ACP, on the "can this actually settle?" layer.

For a merchant, the strategic point is narrow and important. A payment rail an agent cannot complete a purchase over is a reason for that agent to route around a merchant entirely, which makes rail support table stakes for being selectable, even though the rail itself never decides which of several eligible merchants an agent picks.Hypothesis (our analysis) In other words, these protocols are a floor you have to be on, not a lever you pull to win. The four below are the ones worth knowing by name.

AP2: the Checkout and Payment Mandates

AP2 is the payment layer built to sit alongside the agent-interoperability standards. Google announced the Agent Payments Protocol (AP2) on 16 September 2025 as an open, payment-method-agnostic protocol that extends the Agent2Agent (A2A) and Model Context Protocol (MCP) standards to cover how an agent is authorized to pay.Spec-factGoogle Cloud: Announcing the Agent Payments Protocol (AP2) Note the exact name: it is the Agent Payments Protocol (plural), and it is designed to work across payment methods rather than being tied to one card network.

The part of AP2 a merchant actually needs to understand is its accountability model. The current AP2 specification (labeled v0.2) structures an agent-led purchase around two signed Mandates, a Checkout Mandate (the merchant's cryptographic proof the shopping agent is authorized to purchase the checkout) and a Payment Mandate (proof the agent is authorized to pay for it), verifiable credentials that together form an accountability trail recording what the shopper authorized and what was ultimately charged.Spec-factAP2 specification: ap2-protocol.org The terminology has moved since AP2 first shipped: Google's original September 2025 announcement described the flow as three Mandates (Intent, Cart, and Payment); the specification has since consolidated to the two Mandate types above. The practical read stays the same: AP2 is about producing a tamper-evident record that a purchase was legitimate, so that banks, networks, and merchants can accept agent-initiated transactions with confidence. It is infrastructure for trust in the transaction, not a system that steers demand toward any particular store. The full specification lives at ap2-protocol.org(opens in new tab). We link it rather than restate it, because the spec is the authoritative source for the field-level detail.

AP2's governance changed after launch. Google donated AP2 to the FIDO Alliance in late April 2026, with the transition intended to keep the protocol platform-agnostic and community-led; standardization of the specification now continues inside the FIDO Alliance rather than as a single-vendor spec.ReportedGoogle: Google donates Agent Payments Protocol to FIDO Alliance (2026-04-28) That is a separate, later development from the original September 2025 announcement above, not a correction to it.

Visa Trusted Agent Protocol

Visa's contribution addresses a different question: how does a merchant know the "shopper" knocking on its checkout is a legitimate AI agent and not an abusive bot? Visa and Cloudflare announced the Trusted Agent Protocol on 14 October 2025; it lets merchants recognize and verify trusted AI agents through agent-specific cryptographic signatures, distinguishing legitimate shopping agents from ordinary bot traffic.Spec-factVisa: Trusted Agent Protocol This is an identity-and-attestation rail rather than a checkout schema. Its output is "this agent is who it says it is and is trusted to transact," which a merchant's existing fraud and acceptance logic can then act on.

Both initiatives have since moved from announcement toward pilots. By mid-December 2025, Visa reported hundreds of controlled, real-world agent-initiated transactions in live pilots, more than 30 partners actively developing in the Visa Intelligent Commerce sandbox, Akamai as the latest Trusted Agent Protocol supporter, and a target of bringing secure AI-enabled commerce to consumers by early 2026.ReportedVisa newsroom: Visa and Partners Complete Secure AI Transactions (2025-12-18) Pilot progress as of that date, not general availability.

Mastercard Agent Pay

Mastercard's entry works the card-credential side of the same problem: making a tokenized payment credential safe to hand to an agent. Mastercard announced Agent Pay, its Agentic Payments Program, on 29 April 2025. The program introduces Mastercard Agentic Tokens, built on the tokenization stack behind contactless and card-on-file payments; it will require trusted AI agents to be registered and verified before they can pay on a user's behalf, give consumers complete control over what an agent is allowed to purchase, and make agent-facilitated transactions recognizable to consumers, issuers, and merchants alike. Microsoft is the first named platform collaborator, integrating Azure OpenAI Service and Copilot Studio, with IBM's watsonx Orchestrate on B2B use cases and acquirers like Braintree and Checkout.com on the tokenization side.Spec-factMastercard newsroom: Mastercard unveils Agent Pay Conceptually it is close to Visa's aim from the network side: registered, verified authority for an agent to pay under consumer-set limits, rather than a wide-open card number. Much of the program is announcement-framed: the release describes registration, consumer controls, and transaction recognition as what Agent Pay will do as it rolls out, not as features every issuer and merchant has today.

American Express Agentic Commerce Experiences

American Express joined the same layer in April 2026 with a bundle it calls Agentic Commerce Experiences (ACE). American Express introduced the ACE Developer Kit on 14 April 2026 for select developers, built around five integrated services: Agent Registration (verifying agents so only trusted ones transact on the Amex network), Account Enablement (Card Members registering their cards for agentic transactions), Intent Intelligence (capturing purchase intent to support authentication, authorization, and disputes), Payment Credentials (verified agents paying with tokenized credentials), and Cart Context (sharing cart details around a transaction); the announcement footnotes Agent Registration and Cart Context as services still in development.Spec-factAmerican Express newsroom: ACE Developer Kit announcement The kit half is familiar territory (registration, documented intent, tokenized credentials). The protection half is the newer move, and it is a commitment rather than a live program: under Amex Agent Purchase Protection, American Express says that in the future, when a Card Member authorizes a registered agent and that agent sends Amex the customer's authenticated purchase intent, it will protect eligible customers from charges caused by AI agent error, with terms and conditions to apply.Spec-factAmerican Express newsroom: ACE Developer Kit announcement That is a consumer-facing guarantee attached specifically to agent-initiated purchases, aimed at shopper trust rather than merchant plumbing.

The four at a glance

The shared column is the last one. Whatever each protocol secures (authorization, identity, a scoped token, or a protected registration), none of them is in the business of deciding which store an agent recommends or buys from. That is not an oversight; it is the design.

The payment service providers, meanwhile, have started to abstract these rails away from merchants entirely. Adyen announced Adyen Agentic on 16 June 2026, a three-layer suite (Agentic Feed, Agentic Cart, Agentic Payments) whose payments layer handles authentication, token portability, and merchant-of-record preservation across protocols, explicitly naming UCP, AP2, ACP, and Meta AI checkout among the rails it translates between; at launch it is in limited availability for U.S. enterprise merchants.ReportedAdyen: Adyen Announces Adyen Agentic (2026-06-16) If PSPs keep absorbing rail differences this way, a merchant's job shifts from betting on one protocol to keeping product and offer data clean enough for any rail to carry.Hypothesis (our analysis)

Payment is not selection

This is the positioning line that matters, and the specification draws the boundary itself. The AP2 specification defines only the payment-authorization layer and explicitly places the Commerce Protocol's catalog and discovery details "outside the scope of AP2," leaving how an agent finds and picks a merchant to that separate layer.Spec-factAP2 specification: ap2-protocol.org The payment rail hands off after the agent has already chosen you; it makes the chosen purchase completable and accountable. Getting your store onto these rails removes a reason to be skipped (an agent will not select a merchant it cannot pay), but it adds nothing to why an agent would prefer you over an equally payable competitor.

So treat payment-protocol support the way you treat SSL or a working checkout: table stakes, invisible when it works. The actual contest (the one this handbook exists for) happens one layer up, in the product signals an agent scores when it decides whom to pick. If you have not yet mapped that layer, start with how AI shopping agents choose products, and see the per-engine playbooks on the AI shopping platforms hub.

How this relates to UCP and ACP

It is easy to blur the payment protocols together with the commerce protocols, because they are announced by the same companies and sometimes in the same breath. Keep them on two shelves. The commerce protocols, UCP (Google) and ACP (OpenAI and Stripe), cover discovery and checkout: how an agent finds a product and assembles an order. Even there, the payment side is wider than one provider: PayPal announced on 28 October 2025 that it would adopt ACP and support payments processing for merchants using Instant Checkout in ChatGPT.ReportedPayPal newsroom: OpenAI and PayPal Team Up to Power Instant Checkout and Agentic Commerce in ChatGPT (2025-10-28) The payment protocols on this page cover the settlement and trust underneath that order. A merchant can be perfectly legible to a commerce protocol and still fail to convert if the payment and identity rails cannot authorize the agent's purchase, which is why the two layers are worth implementing and reasoning about separately.Hypothesis (our analysis)

For the head-to-head on the commerce layer (scope, which engine each reaches, and why most catalogs should support both), see UCP vs ACP: which gets you selected. For how the payment layer shows up on a specific engine, the ACP rail that powers ChatGPT's checkout is covered in ChatGPT shopping optimization, and the Google side in Gemini and Google AI Mode ranking. Two-sentence definitions of AP2, ACP, and UCP live in the glossary.