Agentic Commerce: AI Agents as Buyers

The infrastructure now being built to let AI agents discover products, hold payment credentials, and complete purchases on a user's behalf — spanning open protocols from OpenAI and Stripe and competing network-level standards from Visa and Mastercard.

Created 2026-08-26 Last reviewed 2026-08-26

What it is

“Agentic commerce” refers to a cluster of technical standards and payment-network products that let an AI agent — not a human clicking “buy” — search for a product, negotiate a checkout, and authorize a payment, within limits a person has pre-approved. Instead of a shopper browsing a site and entering a card number, a chatbot or autonomous agent completes the transaction directly inside a conversational interface, using credentials that have been scoped in advance to a spending limit, a merchant category, or a specific cart.

The clearest example is OpenAI and Stripe’s Agentic Commerce Protocol (ACP), announced September 29, 2025, which the two companies describe as an open, merchant-friendly standard for transaction processing between AI agents and businesses. Its core mechanism is the Shared Payment Token (SPT), a single-use credential that lets an application like ChatGPT initiate a payment without ever seeing or exposing the buyer’s actual card data. ACP now powers “Instant Checkout” in ChatGPT, letting U.S. users complete purchases from Etsy and, subsequently, Shopify-hosted merchants without leaving the chat. Salesforce announced it would support the protocol in October 2025, and Meta has also been named among the standard’s backers.

Parallel to that application-layer protocol, the card networks have built their own credentialing systems. Visa’s Trusted Agent Protocol, announced in September 2025, issues a “Verified Agent ID” alongside a separately signed consumer consent record, so merchants can distinguish authorized shopping agents from unwanted bot traffic. Mastercard’s Agent Pay, built on its existing Digital Enablement Service, issues “Agentic Tokens” bound at creation to a specific agent identity and a set of cardholder mandates — spend ceilings, merchant categories, time windows. Both networks lean on Web Bot Auth, an authentication layer that lets infrastructure providers such as Cloudflare verify that inbound traffic really is a registered agent rather than a scraper impersonating one.

Why it matters for AI governance and narratives

Agentic commerce is a case study in how quickly AI capability claims convert into financial infrastructure, and in how the framing contest over “agentic AI” plays out commercially rather than only rhetorically. When Visa describes its OpenAI partnership as built to power “the next generation of AI commerce,” and Stripe frames ACP as preserving merchant control over branding and fulfillment, both are making an implicit argument about trust — that autonomous purchasing agents are safe enough, and accountable enough, to be handed real payment rails. That argument runs ahead of the more cautious governance conversation happening elsewhere about agent autonomy, consent, and liability when something goes wrong (a wrong purchase, a compromised credential, a manipulated agent).

The competing-standards dynamic is itself notable: OpenAI/Stripe’s application-layer protocol, Visa’s network-layer protocol, and Mastercard’s rival token scheme are not fully interoperable, which means the infrastructure for “AI buying things” is being built by the same handful of incumbent payment and AI companies that already dominate their respective markets — a consolidation story as much as a technology story. For an observatory tracking how AI is framed and governed, agentic commerce is a leading indicator of how narrowly the definition of “agent” gets operationalized once real money is at stake, and of which actors get to write the rules.

Key facts and dates

Where to learn more

Sources

Primary announcement from Stripe with the September 29, 2025 date, protocol mechanics, and Shared Payment Token detail.
Stripe's own explanation of ACP's design goals and openness claims.
Visa's primary press release on its June 10, 2026 OpenAI partnership, directly referenced in the editorial passage.
Confirms ACP adoption timeline and additional backers beyond OpenAI/Stripe.
Independent technical explainer comparing Visa's Trusted Agent Protocol and Mastercard's Agent Pay, and the shared Web Bot Auth layer.
Referenced in: Editorial No. 282