AI commerce protocols split into layers: shopping journey, payment authorization, agent trust and machine payments, on top of base layers like MCP and A2A. This page tracks where each one stands, written for marketers, ecommerce managers and CMOs.
Our assessment for business leaders, based on the sources on this page. Facts carry a link. Everything marked "Assumption" or "Our view" is not a source claim.
Unknown: whether this brings extra revenue or only moves existing revenue to a new channel. No official public data shows either.
Our view: treat it as a bet you can size. The base work (clean product data, measurement) pays off in your current channels too. Spend on checkout integrations only when your own numbers justify it.
Fact: the purchase can happen over an API with no page visit (see Measuring AI traffic).
Risk-benefit balance (our view): the downside of the base work is small and reusable. The downside of a deep custom integration is real: specs and platform strategies still move. So: low regret first, big bets only with a stop rule.
Will this drive incremental revenue?
Honest answer: unproven. We found no official, public data that shows incremental revenue from agentic checkout, and we show no numbers. It is a bet. Make it a bet you can measure and stop.
1. Size the bet with a risk assessment
What does it cost (build, run, fees) and what is it worth if it only moves existing sales? If the answer is "it still pays", the bet is safe.
What breaks if a spec or platform changes? Prefer what your platform or PSP maintains for you.
2. Choose your bet type
Small experiment: one surface, a part of the catalog, a fixed period, a pre-agreed stop rule. Example: enable what Shopify, Stripe, PayPal or Adyen already offers and measure for one quarter.
Moonshot: an own agent, a ChatGPT app or a custom UCP integration. Only with a budget you can lose and a learning goal, not a revenue promise.
3. Measure before you switch on. Without a baseline you cannot tell new from shifted revenue.
Layer
What to measure
How
Web analytics
Sessions, orders and revenue from AI assistants
UTMs on your own feed links and referrer segments, see Measuring AI traffic. Expect undercounting.
Server or CDN logs
Visits by AI crawlers and agents, per user agent; blocked requests
Your web server or CDN logs, filtered on the AI user agents in robots.txt. Bot analytics in your CDN if available.
API and MCP calls
Calls per endpoint (catalog, cart, checkout), errors, latency
Logs on your UCP or ACP endpoints and MCP server.
Agent-attributed orders
Orders, revenue, average order value, returns, chargebacks per agent or surface
Order source field set by the protocol or integration; stored in your order system, not only in analytics.
Incrementality
Is total revenue higher than without the channel?
Hold-out test: switch the channel on for part of the catalog or one market, compare with a control. Our recommendation, not a source claim.
The first touch: partly not. The assistant, not your site, does the comparison. Your homepage, content and on-site merchandising matter less in that moment. Assumption, based on how these surfaces work.
Data: you share product data (which is public anyway) and receive order data. What the platform learns from the conversation is governed by its terms, not by you. Check each platform's merchant terms.
Brand: the agent describes your product in its own words. Rich, correct product data is your lever.
Disintermediation: if your moat is price or catalog breadth alone, agents make comparison easier. If it is brand, assortment, service or delivery, give the agent the data to show that. Our view.
Not joining is also a choice: blocking agents keeps control but makes you invisible on those surfaces. The site audit shows what you block today.
Early. Many specs are beta, draft or announced only. Good for learning, risky for deep custom builds.
Is there demand?
Unknown for your shop. Check your own logs and analytics first; that is your best data.
Which KPIs?
AI-assistant sessions and revenue, agent visits in logs, API and MCP calls, agent orders, AOV, return and chargeback rate, incremental revenue from a hold-out test.
Recommendation: tag every feed link yourself, following Simon Vreeman's UTM convention (opens in new tab). Required:utm_source and utm_medium (lowercase, no duplicates, tagged URL returns 200). Optional:utm_campaign, utm_content, utm_term, utm_source_platform, utm_creative_format and utm_marketing_tactic. For AI assistants pick a per-assistant source such as chatgpt.com, gemini, perplexity, copilot or claude, and choose the medium yourself (not referral). The templates use {ai_medium} as a placeholder.
Choose your AI medium (the site does not pick for you):
Option B: your own medium, for example ai, plus a GA4 custom channel group placed above Referral. Without that custom group the traffic lands in Unassigned.
If you pick Option B, create a custom channel group with an AI assistants channel that matches your chosen Medium exactly OR Session source matching chatgpt\.com|gemini\.google\.com|perplexity\.ai|copilot\.microsoft\.com|claude\.ai.
Recommended templates (not platform requirements). Required: utm_source, utm_medium. Optional: the rest. Replace {ai_medium} with your choice (see options above).
Conflict to know: if a platform appends its own utm_source to a URL that already has one, the result depends on the analytics tool. Using chatgpt.com as your own source value avoids a split. With Google Ads auto-tagging, the click id usually wins over your UTMs (assumption).
Referrer segments (complement): the same source regex above catches untagged visits. These hostnames are the public addresses of each assistant; that they appear as referrers is observed or assumed, not documented by the vendors. Referrers are often stripped by apps, so expect undercounting.
Developers: full table with the official rules in the Dev view.
The protocols in plain words
UCP
1Discovery
2Product data
3Cart and checkout
4Payment
5Trust and identity
6Post-purchase
Covers almost the whole journey: an AI surface finds your shop, reads your catalog, builds a cart, checks out and handles the order afterwards, while you stay merchant of record. Open standard co-developed by Google, Shopify and others.
What it means
Shoppers can find, buy and get post-purchase support from you inside AI surfaces while you stay merchant of record
Channels
Google Universal Cart in AI Mode in Search and the Gemini app (US, since 15 Oct 2026); any agent or app via Shopify Shop MCP
Who supports it
Google, Shopify, Etsy, Wayfair, Target, Walmart and more; PayPal via Braintree or PayPal Orders v2 (Google Pay payment handler)
Maturity
UCP checkout live in the US via Google Universal Cart since 15 Oct 2026 (Google Pay checkout or handoff to the merchant cart, merchant stays seller of record); Lodging draft specification available (not yet in a release); Food coming soon
What to do now
Keep product data clean and check whether your platform or PSP supports UCP
Sits at product data, cart and checkout: lets an agent such as ChatGPT buy from you with payment credentials passed securely, while you stay merchant of record. Maintained by OpenAI and Stripe, per the ACP repo; Stripe's docs say it was created by Stripe, OpenAI and Meta.
What it means
Sell to high-intent buyers through AI agents while keeping the customer relationship
Channels
ChatGPT: Shopify and Etsy catalogs already integrated, other merchants apply
Who supports it
OpenAI, Stripe (maintainers); Meta (co-creator, per Stripe docs); PayPal via Braintree
Maturity
Beta
What to do now
Apply via the AI platform if relevant and check PSP support
Sits before the purchase: a person's own AI agent finds your business, signs in to their account with you and acts on their behalf. Draft from Sierra and Meta, no payments yet.
What it means
Customers' own AI agents can sign in and handle tasks on their account with you
Channels
Personal agents such as Meta's
Who supports it
Sierra, Meta, Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, Walmart and design partners including OpenAI
Sits at payment: gives you signed proof that the shopper really authorized the agent to pay. Created by Google, now being standardized in the FIDO Alliance.
What it means
Cryptographic proof that the customer approved the purchase, which helps with fraud and disputes
Sits at trust: lets your site recognize a trusted Visa shopping agent and tell it apart from a malicious bot while it browses, and can carry consumer and payment details at checkout.
What it means
Tell trusted shopping agents apart from bad bots
Channels
Agents onboarded with Visa
Who supports it
Visa
Maturity
Live in Europe
What to do now
Verify TAP signatures (key retrieval plus RFC 9421 check), usually via your CDN; agents onboard through Visa Intelligent Commerce. Visa publishes no public step-by-step onboarding guide.
Sits at payment: a registered agent pays with a tokenized Mastercard credential instead of a raw card number. Agent Pay for Machines extends this to micro-payments. Agents are credentialed with Mastercard Verifiable Intent so they can be recognized across ecosystems. Since 30 September 2026, trust and intelligence services add a probability score that a transaction was initiated by an AI agent, in testing in the US.
What it means
Agents pay with tokens instead of raw card numbers
Who supports it
Mastercard
Maturity
Rolling out; AI-agent probability score in US testing since 30 Sep 2026
Will sit at trust: Visa, Mastercard and Ant International will explore common principles, building on the SAFR framework, via BuildFin.ai; each has its own protocol (TAP, Verifiable Intent, Agentic Mobile Protocol). Announced 10 September 2026, no spec yet.
What it means
One way to recognize agents across Visa, Mastercard and Ant
Sits at trust: a site or API answers an agent request with a PROOF-REQUEST header, and the agent returns a verifiable credential (OpenID4VP over the W3C Digital Credentials API) proving who authorized it before access is granted. Payment stays with HTTP 402 protocols such as x402. Proof says it plans to submit x401 to the FIDO Alliance: "Proof will submit x401 to the FIDO Alliance's agentic authentication standards workgroup." (launch release, 25 Jun 2026).
What it means
A site or API can ask an agent to prove who authorized it, such as verified identity, age or membership, before granting access
Sits at payment for pay per request: your server answers an unpaid request with HTTP 402, the agent pays and retries. Built for small automated payments rather than a classic cart.
What it means
Charge per request for APIs or content, no account or form needed
Channels
Agents and apps calling your API
Who supports it
x402 Foundation and members; American Express says it supports the x402 Foundation's work (Oct 13, 2026)
Maturity
Live
Effort
One line of middleware per the docs
What to do now
Relevant for API or content sellers, not for retail checkout
Sits at payment for machine to machine purchases over HTTP 402. Payment methods per mpp.dev: Tempo stablecoins, Stripe, cards via encrypted network tokens, Bitcoin over Lightning, EVM, Solana, Stellar, XRPL, Monad, NEAR Intents, RedotPay, or custom; plus sessions and subscriptions. From Stripe and Tempo.
What it means
Charge agents per API call, session or subscription
Sits at checkout and payment: a PayPal or Braintree integration makes your checkout available to agents in ChatGPT (ACP, via Braintree) and Google AI Mode and Gemini (UCP, via Braintree or PayPal Orders v2). An integration, not a protocol.
Not a journey stage but plumbing between agents from different vendors, for example a shopper's agent and your shop's agent. Originally from Google, now at the Linux Foundation.
What it means
Lets agents from different vendors work together
Who supports it
Linux Foundation; steering committee with AWS, Cisco, Google, IBM, Microsoft, Salesforce, SAP, ServiceNow
Sits in the browser at cart and checkout: a web page registers structured tools, such as checkout, that an AI agent in the user's browser can call, via JavaScript (imperative API) or annotated HTML forms (declarative API). A proposed web standard in a Chrome origin trial, primarily designed for local browser workflows with a human in the loop.
What it means
AI agents in a shopper's browser can use your checkout and filters as structured tools instead of guessing at the page
Channels
Browser agents in Chrome (origin trial)
Who supports it
Google Chrome; Shopify checkout supports it since 28 Sep 2026
Maturity
Proposed web standard, Chrome origin trial; subject to change
What to do now
On Shopify, checkout tools need no merchant configuration per Shopify; otherwise watch or join the origin trial
Tag your own feed links with required UTMs: utm_source and utm_medium (for example utm_source=chatgpt.com&utm_medium={ai_medium}), lowercase, following Simon Vreeman's convention at vreeman.com/utm (opens in new tab). For AI assistants pick a per-assistant source and choose the medium yourself (not referral). Option A:utm_medium=ai-assistant lands in GA4's built-in AI Assistant default channel (opens in new tab) with no setup. Option B: your own medium (for example ai) plus a GA4 custom channel group placed above Referral; without that group the traffic lands in Unassigned. Optional: utm_campaign, utm_content, utm_term, utm_source_platform, utm_creative_format and utm_marketing_tactic. This is a recommendation, not an OpenAI rule: OpenAI's feed spec only asks for a stable product URL. Also segment on the referrer chatgpt.com, and on gemini.google.com, perplexity.ai, copilot.microsoft.com and claude.ai, knowing those referrers are observed rather than documented.
12 Oct 2026: Public MCP server at vreeman.ai/commerce/mcp and a site audit (also at /commerce/api/audit). New Access items for AI crawlers and agents in robots.txt, Merchant Center crawlers and Cloudflare AI bot policies. The ChatGPT UTM guidance no longer relies on an OpenAI Help article: shops tag their own feed URLs and segment on the referrer.
12 Oct 2026: AI medium is a shop choice: templates use {ai_medium}. Option A utm_medium=ai-assistant (GA4 built-in AI Assistant channel); Option B own medium (e.g. ai) plus custom channel group above Referral, else Unassigned. Conversational attributes remain Optional.
12 Oct 2026: Earlier pass prescribed utm_medium=ai; superseded by the neutral choice above.
12 Oct 2026: UTM guidance aligned with vreeman.com/utm: required utm_source and utm_medium only; campaign, content and other params optional. Referrer regex escaping fixed on Business.
12 Oct 2026: Added UTM tagging per surface (Simon Vreeman convention) and referrer segments.