The checkout button an AI agent presses for you
Before an AI agent can pay on someone's behalf, the merchant has to check who the bot is and the card network has to check that a person approved the purchase. This map sorts out which check is handled by Visa's and Mastercard's tokens, Cloudflare's signatures, Google's mandates and the checkout protocol from Stripe and OpenAI. None of these specifications yet says who bears the loss when an agent buys the wrong thing.
The brief, in full
For an AI agent to finish a purchase on someone's behalf, several parties have to check different things. The merchant asks who the incoming bot is. The card network and the bank ask whether a person actually approved the payment. The user is left with a third question: who is responsible if the agent buys the wrong thing. The specifications released since 2025 by Visa, Mastercard, Google, Stripe and OpenAI answer the first two questions first.
Who is the bot at the door?#
A signature on every request
Bot defenses on shopping sites start from suspicion of any visitor that is not a person. Left as they are, they block an agent that came to buy along with the malicious bots. The answer that emerged is for agents to sign each request cryptographically and say who they are. The merchant verifies that signature with a public key before deciding whether to let the agent in.
open_in_newblog.cloudflare.com/web-bot-authNames and IP addresses are not enough#
The Web Bot Auth proposal of May 2025
In May 2025 Cloudflare proposed a way for bots to sign their requests. The User-Agent string a browser sends is easy to fake, and a single IP address can be shared by many users behind a VPN or proxy. The proposal uses HTTP Message Signatures, standardized as RFC 9421, and carries the signature's validity window and key information in headers.
Three things Visa's TAP checks#
Intent, customer, payment details
In October 2025 Visa released the Trusted Agent Protocol (TAP), built with Cloudflare. It lets a merchant check whether an agent is trusted, whether it came to browse or to buy, and whether the customer behind it already has a relationship with the store. Payment details can be carried along when needed. The specification is published on GitHub.
Only registered agents can pay#
The premise of Mastercard Agent Pay
When Mastercard announced Agent Pay on April 29, 2025, it required AI agents to be registered and verified before they can pay on a user's behalf. In October of the same year it said it would add Web Bot Auth to Agent Pay so that merchants can recognize trusted agents. American Express said it would use the same approach.
What the agent gets instead of a card number#
A token issued for the agent
Card networks issue tokens so that agents never receive the real card number. A token hides the number and carries conditions with it, such as which agent is using it and how much it may spend. It extends the tokenization already used for contactless phone payments and cards stored on file to agent payments.
open_in_newusa.visa.com/about-visa/newsroom/press-releases.releaseId.21361.htmlVisa's cards for AI payments#
The user sets the limits and conditions
Visa announced Visa Intelligent Commerce on April 30, 2025. It replaces card details with tokenized credentials, and the token confirms that the agent a user chose may act for that person. The user sets spending limits and conditions, and transaction signals reach Visa in real time. Anthropic, OpenAI, Microsoft and Stripe were among the named partners.
Mastercard Agentic Tokens#
Existing tokenization stretched to agents
Mastercard's Agentic Tokens extend the tokenization it already uses for contactless payments, cards on file, Payment Passkeys and recurring payments to agent payments. Card issuers get more visibility and control over tokens used on agent platforms. Consumers, issuers and merchants can all tell which transactions went through an agent.
One seller, one amount, one deadline#
Stripe's shared payment tokens
A Stripe shared payment token (SPT) is a payment grant an agent hands to a single seller. Each token carries a currency, a maximum amount and an expiry time, and the agent sets the maximum to the total of the purchase. Looking up a token shows only limited card details such as the brand and last four digits. Once the agent revokes a token, no payment can be created with it.
Proof that a person said yes#
Signed mandates
A token shows whose money is paying, but it does not prove that the person asked for this item at this price. Google's Agent Payments Protocol (AP2), released in September 2025, fills that gap with mandates. A mandate is a digital document with a cryptographic signature that prevents tampering. More than 60 companies and organizations in payments and technology worked on it.
open_in_newap2-protocol.org/ap2/specificationWatched payments and delegated payments#
The two cases AP2 separates
AP2 splits payments by whether a person is present at the moment of purchase. If the user is present, they see and approve the final cart and payment themselves. If not, the user approves conditions in advance and the agent builds a cart within them. Version 0.2, released in April 2026, gives buying limited-run tickets the moment they go on sale as an example of a payment with no person present.
Separate signatures for the cart and the payment#
Checkout Mandate and Payment Mandate
The version 0.2 specification has two mandates. The Checkout Mandate is verified by the merchant and proves the agent may buy that cart. The Payment Mandate is verified by the credential provider, the card network and the payment processor, and is bound to the cart by a hash of the checkout. When AP2 was announced in September 2025, it led with the names Intent Mandate and Cart Mandate.
April 2026: the specification moves to FIDO#
From one company's spec to a shared standard
On April 28, 2026 Google said it would hand AP2 to the FIDO Alliance, the authentication standards body. Verifiable Intent, built with Mastercard, went with it. The same day FIDO set up working groups on agent authentication and on payments. Mastercard and Visa chair the payments group, and CVS Health, Google and OpenAI chair the authentication group.
When checkout moves into the chat#
The seller is still the seller
Instead of clicking through a store's website, an agent can now place an order directly inside a chat. If it is not settled first who is selling, it becomes unclear who handles refunds and delivery. The protocol from Stripe and OpenAI states that the business remains the merchant of record. The seller keeps control of products, payment processing and fulfillment.
open_in_newstripe.com/blog/developing-an-open-standard-for-agentic-commerceACP and Instant Checkout in ChatGPT#
September 2025, starting with Etsy sellers
Stripe and OpenAI released the Agentic Commerce Protocol (ACP) on September 29, 2025. It is an open specification under the Apache 2.0 license, and ChatGPT is its first implementation. With the launch, Instant Checkout inside ChatGPT opened between US users and US Etsy sellers. More than a million Shopify merchants were said to be coming next.
A route that skips the card networks#
x402 and stablecoins
Not every agent payment runs over the card networks. Alongside AP2, Google released the A2A x402 extension for agent crypto payments, built with Coinbase and others. In October 2025 Cloudflare said it was setting up the x402 Foundation with Coinbase. On this route, digital assets such as stablecoins move instead of card tokens.
Who pays when the agent buys wrong?#
A box still left empty
AP2 lists accountability among the problems the protocol has to solve, alongside authorization and authenticity: who is responsible when a fraudulent or mistaken transaction happens. Mandates and signatures record what happened, but the record alone does not decide who absorbs the loss. None of the announcements and specifications gathered in this map sets out how liability is shared.
The liability of handing over your card#
How US Regulation Z reads it
Regulation Z, the US rule on consumer credit, treats use by a person without authority as unauthorized use and caps the cardholder's liability at 50 dollars. Its official interpretation says that if a cardholder gives the card to a family member or coworker who then exceeds the authority given, the cardholder is liable until the issuer is notified. Whether an agent that goes beyond its instructions counts as that family member has not been settled.
Evidence kept, losses not divided#
Between dispute tools and liability rules
The card networks have built tools for disputes. Visa said it would use real-time signals from agent transactions for transaction controls and dispute management, and Mastercard said it would offer a process to clarify agent transactions a cardholder does not recognize. AP2 notes that mandates and receipts can serve as evidence in a dispute. All three keep evidence. None of them is a rule for dividing losses.
Sources & related
Want this built for real?
Once the brief is read, the next question is usually how to actually build it. Weple is an outsourced development studio that takes structures like the one on this page and ships them in short, scoped pieces. Send this page along with your inquiry.
Ask about building it