Agent Payments Explained: How AP2, ACP and Card Networks Let AI Agents Buy Things Safely

Letting an AI agent buy things raises a question payment systems were not built for: the person who approves a purchase and the software that makes it are no longer the same. In 2025 and 2026, Google, OpenAI with Stripe, Visa and Mastercard each published an answer. Underneath the brand names, they solve the same three problems.

Three things to prove

1. Consent. The user approved this purchase, or approved the rules the agent is buying within.
2. A limited credential. What the agent presents can only be used for this task, not as a general card number.
3. Agent identity. The merchant can tell a registered shopping agent from a scraper or a fraud bot.

Consent: mandates

Google's Agent Payments Protocol (AP2) represents consent as signed mandates. When the user is present, the merchant signs the checkout, the user reviews the exact items and price on a trusted surface (a wallet or banking screen that the specification says must not be the agent itself) and signs a closed mandate bound to a hash of that checkout. When the user is away, they sign an open mandate in advance: which merchants, how much, until when, and which agent key may act. The agent later signs closed mandates that must fit inside it. AP2's first version in September 2025 called these Intent and Cart mandates; the v0.2 specification restructured them as Checkout and Payment mandates carried as SD-JWT credentials.

The key property: if a product page injects instructions into the agent, the agent can be steered, but it cannot widen what the user signed.

Credentials: scoped tokens instead of cards

The Agentic Commerce Protocol, published by OpenAI and Stripe in September 2025, pairs with Stripe's Shared Payment Token. The token lets the agent platform start a payment without seeing the buyer's card, and it is bound to one seller, a currency, a maximum amount and an expiry, and can be revoked. Visa Intelligent Commerce and Mastercard Agent Pay, both announced in April 2025, give agents network tokens in place of card numbers, with limits the consumer sets.

Identity: signed requests

Merchants and bot-management systems need to know which agent is knocking. Visa's Trusted Agent Protocol and Mastercard's agent framework both use Web Bot Auth: the agent signs each HTTP request with RFC 9421 message signatures, the signature names a key in a published directory, a tag says whether the agent is browsing or paying, and timestamps plus a nonce prevent replay. A valid signature proves which agent sent the request. It does not prove the user wanted the purchase; that is the mandate's job.

What is still unsettled

None of these specifications decides who pays when a correctly authorised agent buys the wrong thing: the wrong size, a dubious seller, a price technically under the limit. AP2 lists accountability as an open problem, and card networks say the purchase-intent data they collect will help disputes. The products are moving too. In March 2026, OpenAI scaled back checkout inside ChatGPT and moved it to merchants' own apps and sites.

For anyone building agents that pay: keep open mandates narrow (merchant lists, low ceilings, short expiry), ask the user again for first-time merchants or amounts near the limit, send receipts for every purchase, and make revocation easy.

In interviews

Expect "design payments for a shopping agent". Reject the stored-card design, separate consent, credentials and identity, explain how each one survives prompt injection, and name liability as unresolved. The full scored answer is agent payments security. For the identity layer, see how websites verify AI agents, and for approvals bound to exact arguments, binding approval to the action.