Agentic payments: the fundamentals. 7 chapters and a final quiz.

Chapter 1. When AI goes to checkout.

Until now, every online payment assumed a human in front of a screen, choosing, clicking, and authenticating. Agentic payment breaks that assumption. An AI agent is given a goal: “find me a Paris–Tokyo flight under €700.” Whether it is a conversational assistant, a replenishment agent, or a software bot connected to an API, it searches the offers, builds a cart, and triggers the payment itself, within the limits of the mandate its user has set.

Four types of use cases

Three neighboring mechanisms are often confused with it. Amazon’s one-click and wallets such as Apple Pay speed up a purchase the human has decided on; a subscription repeats an identical purchase. Agentic payment, by contrast, hands software the decision itself: which product, which merchant, and when. That shift upends authentication, evidence, and the allocation of liability.

Chapter 2. Anatomy of an agentic transaction.

Before comparing protocols, let’s lay out the skeleton every agentic transaction shares. It comes down to three questions that traditional e-commerce answered implicitly: the agent’s identity, the authorization that limits what it may do, and proof of consent that holds up after the fact. Each protocol from 2025–2026 answers these three questions differently.

The three problems to solve

• Identity: the merchant has to tell ChatGPT’s legitimate agent apart from a fraudulent bot spoofing its User-Agent. The emerging answer is verifiable HTTP signatures (Web Bot Auth, being standardized at the IETF).
• Authorization: what the agent can buy has to be bounded. Current answers are signed mandates (AP2), tokens with a limited scope (Mastercard Agentic Tokens), and merchant-controlled checkout sessions (ACP).
• Proof: in a dispute, the user’s consent has to be demonstrable. The answer lies in verifiable credentials that are timestamped, tamper-proof, and enforceable (non-repudiation).

Chapter 3. AP2: Google’s mandate protocol.

On September 16, 2025, Google announced the Agent Payments Protocol (AP2), an open standard developed with more than 60 partners, including Mastercard, PayPal, American Express, Coinbase, and Salesforce. Google’s thesis is that the central problem in agentic payments isn’t settlement, since the rails already exist, but proof of consent. AP2’s answer is “mandates”: signed objects that travel with the transaction.

{
  "type": "IntentMandate",
  "user": "did:example:romain",
  "agent": "did:example:assistant-shopping",
  "constraints": {
    "max_amount": { "value": 100, "currency": "EUR" },
    "categories": ["chaussures"],
    "expires_at": "2026-07-31T23:59:59Z",
    "human_present": false
  },
  "proof": {
    "type": "DataIntegrityProof",
    "verificationMethod": "did:example:romain#key-1",
    "signature": "zQmVbase58..."
  }
}

AP2 distinguishes human-present scenarios (the user approves the cart and signs live) from human-not-present ones (the agent acts alone within the bounds of the Intent Mandate). Traditional e-commerce has no such distinction, and it drives the entire risk analysis. The narrower and more recent the mandate, the more defensible the transaction. Academic researchers have already red-teamed the protocol with prompt injections designed to hijack mandates. Cryptography doesn’t protect against flaws in the agent itself.

Chapter 4. ACP: OpenAI and Stripe collapse the checkout flow.

In late September 2025, OpenAI and Stripe unveiled the Agentic Commerce Protocol (ACP), the open standard that powers Instant Checkout, buying directly inside ChatGPT. Where AP2 theorizes about trust, ACP ships a product. US ChatGPT users could buy first from Etsy sellers, then from more than a million Shopify merchants (Glossier, SKIMS, Vuori, and others), before the rollout expanded in early 2026.

Discovery no longer starts with the search engine or the merchant’s website, but with the conversation. The merchant keeps the order, the logistics, and the customer relationship; it gives up the interface and pays a referral fee. The trade-off echoes the marketplace model, carried over to AI assistants.

Chapter 5. x402 and pay-per-crawl: HTTP 402 brought back to life.

The HTTP status code 402 Payment Required had sat dormant in the web’s specification since the 1990s, “reserved for future use.” That future has arrived. In May 2025, Coinbase launched x402, an open standard that turns any URL into a tollbooth payable in stablecoins. It is built for machines paying machines: no account, no card, no subscription.

GET /api/meteo/paris HTTP/1.1
Host: exemple.fr

HTTP/1.1 402 Payment Required
Content-Type: application/json

{ "maxAmountRequired": "0.001", "asset": "USDC",
  "network": "base", "payTo": "0xAbc...123" }

GET /api/meteo/paris HTTP/1.1
Host: exemple.fr
X-PAYMENT: eyJzaWduYXR1cmUiOiIweDQ0Li4uIn0

HTTP/1.1 200 OK

Pay-per-crawl: charging AI bots

Cloudflare applied the same logic to AI crawlers with pay-per-crawl (beta launched July 1, 2025). It lets a publisher choose, bot by bot, between free access, paid access (via a “crawler-price” header), or blocking. Stack Overflow adopted the system, in which Cloudflare acts as merchant of record, in February 2026. Starting September 15, 2026, “mixed” crawlers (search plus training) are blocked by default on many sites. The network already issues more than a billion 402s a day. Web content is no longer free for machines.

Chapter 6. Visa and Mastercard: the incumbent rails strike back.

The card networks have no intention of letting agents pay in stablecoins outside their rails. One day apart, in late April 2025, Mastercard launched Agent Pay (April 29) and Visa launched Intelligent Commerce (April 30). Their shared weapon: tokenization, extended to agents.

Mastercard’s Agentic Tokens show the networks’ philosophy. A standard card token is bound to a device; an agentic token is bound to an identified agent, a merchant scope, and a consent policy. ChatGPT or Copilot can complete a purchase without ever seeing the PAN, and the issuer knows it is authorizing an agent transaction, so it can score it differently. Cloudflare is working with Visa, Mastercard, and American Express to plug Web Bot Auth identification into these systems.

Chapter 7. Trust, mandates, and the state of play in 2026.

By mid-2026, agentic payments have left the lab but remain tiny in volume. Agent traffic converts well; live transactions number in the thousands on the card rails and in the hundreds of millions for x402 micropayments. The battle is over trust. Without solid proof of the mandate, every dispute becomes hard to resolve.

• Agent identity: verifiable cryptographic signatures (Web Bot Auth, Trusted Agent Protocol) rather than a self-declared User-Agent.
• User mandate: signed verifiable credentials (AP2), bounded sessions (ACP), covering scope, spending limit, and expiration.
• Protected instrument: delegated tokens with a restricted scope; the agent never holds the PAN or unlimited access.
• Enforceable audit trail: every step timestamped and signed, so the chain of consent can be reconstructed in a dispute.

Three worlds coexist in 2026: verifiable mandates (AP2) as the proof layer, delegated checkout (ACP) as the experience layer, and stablecoin micropayments (x402) as the machine-to-machine layer. Meanwhile, Visa and Mastercard are tokenizing agents to keep them on their rails. These building blocks complement each other more than they compete. The next course shows you how to integrate them on the merchant and PSP side.