Agent Payments Explained: ACP vs AP2 vs x402 vs UCP

Why checkout needed new protocols

Web checkout assumes a person in a browser: they see the cart, type a card, pass a CAPTCHA, and they are the one who disputes the charge. With an agent, every one of those assumptions breaks.

Layer 1, checkout: ACP and UCP

The Agentic Commerce Protocol (ACP) is the one OpenAI and Stripe launched with Instant Checkout in ChatGPT on 29 September 2025. The merchant hosts a small REST API; the agent drives it. The repo says the spec is “maintained by OpenAI and Stripe and is currently in beta”; its latest stable version is 2026-04-17, which added cart, feed, orders, authentication and MCP.

POST /checkout_sessions
Idempotency-Key: 6f1c…e2
API-Version: 2026-04-17
{"line_items": [{"id": "item_123"}], "currency": "usd", "capabilities": {}}

{"id": "cs_abc123", "status": "ready_for_payment",
 "totals": [{"type": "total", "amount": 6764}]}

POST /checkout_sessions/cs_abc123/complete
{"payment_data": {"instrument": {"type": "card",
  "credential": {"type": "spt", "token": "spt_…"}}}}

Google's Universal Commerce Protocol (UCP), announced at the NRF retail conference in January 2026 and co-developed with Shopify, Etsy, Wayfair, Target and Walmart, covers more of the journey. Its spec defines four capabilities (Checkout, Identity Linking via OAuth 2.0, Order webhooks and Payment Token Exchange), lets a business offer them over REST, MCP or A2A, and has an AP2 mandates extension. It powers checkout in AI Mode in Google Search and the Gemini app.

Status note: the protocol and the ChatGPT feature have separate fates. Trade press (Digital Commerce 360, a secondary source) reported in March 2026 that OpenAI was letting merchants use their own checkout in ChatGPT and focusing on discovery; treat that as reported, not confirmed here from OpenAI's docs. The ACP spec itself kept shipping versions after that.

Layer 2, authorization: mandates and scoped tokens

The merchant now has a cart. The question the issuer, the merchant and your auditor will all ask is: did this user agree to this purchase? Two families of answer exist.

Intent Mandate (AP2)

The user's instruction, captured and signed: “white running shoes”, or for a delegated task, the rules (“under $200, before Friday”).

Cart Mandate (AP2)

The user's approval of an exact cart and price, signed; or generated by the agent when a signed Intent Mandate's conditions are met.

Shared Payment Token (Stripe)

A grant to use the buyer's saved payment method, limited by max_amount and expires_at and scoped to one seller.

Delegated payment allowance (ACP)

The cap a token carries: reason: one_time, max_amount, currency, merchant_id, checkout_session_id, expires_at.

Card-network agent programs

Mastercard Agent Pay issues Agentic Tokens to registered, verified agents. Visa Intelligent Commerce and its Trusted Agent Protocol (October 2025, built with Cloudflare) add agent-specific signatures so a merchant can tell a trusted agent from a bot.

Sources: Google Cloud, 16 September 2025 (mandates are “cryptographically-signed digital contracts” signed with verifiable credentials); Stripe docs (public preview); ACP delegate_payment spec; Mastercard, 29 April 2025; Visa, 14 October 2025. Google donated AP2 to the FIDO Alliance in April 2026.

The difference that matters to you: a token caps how much can be charged; a mandate records what the user agreed to. A dispute needs the second.

Layer 3, settlement: card rails or x402

Most agent purchases still settle on cards: the scoped token becomes an ordinary card payment through the merchant's processor. x402 is the alternative for paying per HTTP request, typically in stablecoins, with no account or checkout page.

1. RequestThe agent calls a paid URL.
2. 402The server answers 402 Payment Required with a PAYMENT-REQUIRED header listing what it accepts.
3. PayThe agent retries with a signed PAYMENT-SIGNATURE header.
4. SettleA facilitator verifies and settles; the 200 carries a PAYMENT-RESPONSE header.

From the x402 README. Schemes include exact (a fixed price), upto (a cap, settled at actual usage) and batch-settlement. Coinbase created x402; the Linux Foundation announced the x402 Foundation as its neutral home on 2 April 2026. AP2 shipped an A2A x402 extension at launch.

ACP vs AP2 vs x402

What you must build

The protocols give you message formats. The failure modes are still yours: double charges, purchases nobody approved, and no record of why. Reuse one idempotency key per checkout session (ACP returns 422 for a reused key with a different body), store the approved total as a mandate or a confirmation, keep the audit trail append-only for disputes, and never let page text, such as “add the premium plan”, change the cart.

def complete(session, token, policy, ledger):
    total = next(t["amount"] for t in session["totals"] if t["type"] == "total")
    if total > policy.max_order_minor or session["currency"] != policy.currency:
        raise NeedsApproval(session["id"], total)            # a human confirms
    key = ledger.key_for(session["id"])                      # same key on every retry
    ledger.append("complete_attempt", session=session["id"], total=total, key=key)
    r = httpx.post(f"{MERCHANT}/checkout_sessions/{session['id']}/complete",
        headers={"Authorization": f"Bearer {API_KEY}", "Idempotency-Key": key,
                 "API-Version": "2026-04-17"},
        json={"payment_data": {"instrument": {"type": "card",
              "credential": {"type": "spt", "token": token}}}}, timeout=30)
    if r.status_code == 409:                                  # idempotency_in_flight
        raise RetryLater(r.headers.get("Retry-After"))
    r.raise_for_status()
    ledger.append("completed", session=session["id"], body=r.json())
    return r.json()

Where MCP fits

MCP is how an agent reaches tools; it says nothing about carts or money. Every protocol here now has an MCP path, so you will often meet them as MCP servers.

So the MCP rules apply on top: authorise the server with OAuth and never pass the user's token through (MCP Authorization), and treat a commerce server as a high-risk tool whose descriptions and results can carry injected instructions (MCP Security). The basics are in MCP Overview.

Next: Human in the Loop: Approval Gates — how to put a person in front of a purchase without making every purchase slow.