Agentic Commerce Protocols Explained: ACP, UCP, AP2 and Agent Payments

1. 01

   ACP (Agentic Commerce Protocol) is the open standard from OpenAI and Stripe behind ChatGPT shopping. Since March 2026 it carries product feeds for discovery too.

2. 02

   UCP (Universal Commerce Protocol) is Google's counterpart, co-developed with retailers and platforms including Shopify and Walmart. It powers checkout in AI Mode and Gemini.

3. 03

   Agent payment programs (AP2 plus the card network and wallet schemes) answer a narrower question: did a trusted agent pay with the shopper's permission.

4. 04

   Every protocol starts from the same input, a structured product catalog. If an agent can't match your product to the request, nothing downstream gets called.

5. 05

   Most merchants won't build protocol endpoints. Their platform or payment provider exposes them (Shopify, Stripe, PayPal, Salesforce, Merchant Center). Your job is the product data.

Who backs ACP and how it evolved

OpenAI and Stripe are the founding maintainers. The spec lives on GitHub under Apache 2.0, uses date-based versions and is still labeled beta. It launched alongside Instant Checkout in ChatGPT, first for US Etsy sellers, with Shopify merchants such as Glossier, Vuori, Spanx and SKIMS announced next (Stripe). You don't need Stripe as your processor to adopt it.

The 2026-04-17 release added cart, feed, orders, authentication and MCP support (ACP repository).

Then the checkout story changed. On March 24, 2026, OpenAI said the first version of Instant Checkout "did not offer the level of flexibility" it wanted. Merchants can now use their own checkout experiences, and ACP was extended to power product discovery (OpenAI). Feeds and promotions go through ACP directly or via providers such as Salesforce and Stripe; Shopify merchants are covered by Shopify Catalog. OpenAI named Target, Sephora, Nordstrom, Lowe's, Best Buy, The Home Depot and Wayfair as retailers integrated for discovery.

That reversal is why we'd hold off on a hand-built ACP checkout unless you have a payments team. Discovery is the part that touches every merchant.

How ACP works, step by step

1. 1

   Product feed

   You share a structured catalog. Required fields are item_id, title, description, url, brand, seller_name, image_url, availability and price. Flags such as is_eligible_search and is_eligible_checkout control where each product can appear.

2. 2

   Agentic checkout

   You expose REST endpoints: POST /checkout_sessions creates a session, POST /checkout_sessions/{id} updates it, POST /checkout_sessions/{id}/complete completes it, with optional cancel and retrieve. Every response returns the full cart state (taxes, shipping, discounts, totals).

3. 3

   Delegated payment

   The agent passes a scoped credential instead of a card number. Stripe's Shared Payment Token is limited to one merchant and one cart total, and you can still charge through your own payment provider.

4. 4

   Order updates

   You publish lifecycle events such as order.created and order.updated to a webhook, so the agent can keep the shopper posted.

What do merchants need to support ACP?

Discovery needs a feed that meets OpenAI's feed spec. The rules we see broken most often in audits:

OpenAI's checkout spec requires signed, authenticated HTTPS requests (Authorization, Signature, Timestamp, Idempotency-Key) plus conformance checks covering schemas and error codes as well as webhooks. Don't skip the idempotency handling. Agents retry on timeouts, and a handler that ignores the key creates a second order. Products opted into checkout also need privacy policy and terms URLs.

Most merchants reach ACP through a platform: Shopify, Stripe's Agentic Commerce Suite, PayPal or Salesforce. The full playbook is in how to get your products recommended by ChatGPT.

Payments get the most press and, for a typical merchant, the least work. Your PSP absorbs most of it.

Google frames the open questions as authorization, authenticity and accountability (Google Cloud). In plain terms, a merchant needs proof that the shopper approved, proof that the purchase matches what they asked for, and a clear answer on who is liable when something goes wrong.

Who launched what

How AP2 mandates work

AP2 uses two signed digital contracts. The Intent Mandate records what the shopper asked for and the limits they set, say "buy this jacket in green if it drops below $180". The Cart Mandate records the exact items and price that were approved, by the shopper or by the agent within those limits. Google calls the result a non-repudiable chain from intent to cart to payment (Google Cloud). AP2 extends the A2A protocol, works with MCP, and has an x402 extension for crypto payments built with Coinbase.

One practical catch: "in green" only resolves if the variant has a color value an agent can read. A swatch named "Moss" won't do it.

Card networks: tokens and agent identity

Mastercard Agent Pay extends card tokenization to agents. Partners include Microsoft and IBM, plus processors Braintree and Checkout.com. Visa's Trusted Agent Protocol is built on Cloudflare's Web Bot Auth. Mastercard and American Express use it too.

This is where merchants get burned. Bot rules built to stop scrapers will block a paying agent too. Check with whoever owns your CDN or WAF settings that signed agents get through.

PayPal and Stripe on the merchant side

PayPal adopted ACP in October 2025 and said that from 2026 its merchants' catalogs would reach ChatGPT through PayPal's ACP server. Stripe's Agentic Commerce Suite hosts an ACP endpoint for product data with price and availability and processes Shared Payment Tokens. In both cases you stay merchant of record.

The merchant checklist

• Complete product feed

  Core fields on every product (title, description, brand, gtin, price, availability, images) plus variant attributes like color or size.

• Consistent data everywhere

  Price and stock match on the PDP and in every feed or marketplace listing. So do specs.

• Checkout eligibility flags

  is_eligible_checkout in ACP feeds and native_commerce(checkout_eligibility) in Merchant Center, set only on products that qualify.

• Return policy and support contact

  Return cost, window, link, plus a website, email or phone contact. Both appear in agent checkout.

• Tokenized payments

  A PSP that accepts agent tokens or Google Pay, so cards are never exposed.

• Order webhooks

  Order events (created, updated, shipped, refunded) sent back to the agent.

• Agent-friendly fraud rules

  Bot management that recognizes signed, trusted agents instead of blocking them.

• Attribution

  AI channel attribution in order data, to measure agent revenue.

We'd rank the first two above everything else. Checkout failures are loud. Bad product data fails silently, and the agent recommends someone else.

Where product data fits in every protocol

Protocols define the pipes, not what flows through them, and an agent can only recommend what it can read. Google's new conversational attributes and OpenAI's feed best practices point the same way: more structured attributes, plain-text descriptions and accurate variants.

The shoe from earlier, before and after a proper pass:

The usual advice is to write longer descriptions for AI. Length isn't what changed; every claim an agent needs is now a quotable fact.

That's the work of Agentic Commerce Optimization. Start with product feed optimization, then add on-page markup from structured data for ecommerce.