AI commerce protocols

UCP vs ACP vs AP2: developer reference

AI commerce protocols split into layers: shopping journey, payment authorization, agent trust and machine payments, on top of base layers like MCP and A2A. This page tracks where each one stands, written for developers and CTOs.

1. Stack

Who talks to whom, and which protocol carries it. Layers read bottom up: transport, then identity and trust on every request, then the shopping journey, then payment.
AI agentChatGPT, Gemini, Copilot, a personal agent
Merchantyour shop, platform or API
PSP and networksStripe, PayPal, Adyen; Visa, Mastercard
  • Agent → MerchantCatalog, cart, checkout, orders: UCP, ACP, sign-in via Poppy; over REST, MCP or A2A. Request signed with Web Bot Auth (RFC 9421); Visa TAP aligns with it.
  • Agent → PSPGets a scoped payment credential: Stripe Shared Payment Token (ACP), network token (Mastercard Agent Pay), AP2 mandate signed by the user, Amex payment credential scoped by a Proof of Intent Token (Amex Intent Intelligence (opens in new tab)).
  • Merchant → PSPCharges the token or credential and verifies the mandate. The merchant stays merchant of record.
  • Agent → ServerPay per request: server answers HTTP 402, client pays via x402 or MPP and retries.

  1. Layer 4Payment

    • AP2 mandates
    • Mastercard Agent Pay
    • Visa TAP payment data
    • Amex Intent Intelligence
    • x402
    • MPP
    Agent, merchant and PSP. x402 and MPP: client and server only.

  2. Layer 3Shopping journey

    • UCP
    • ACP
    • Poppy (sign-in, no payments)
    • PayPal Agent Ready (integration)
    Agent to merchant. Capabilities are advertised by the merchant (for UCP via /.well-known/ucp).

  3. Layer 2Identity and trust

    • Web Bot Auth
    • Visa TAP
    • Mastercard agent registration
    • KYA (no spec)
    • x401 (draft)
    • OAuth 2.0 identity linking
    Agent proves who it is; merchant or CDN verifies the signature.

  4. Layer 1Transport

    • REST / HTTP
    • MCP (agent to tools)
    • A2A (agent to agent)
    • WebMCP (page to browser agent, origin trial)
    Carries every layer above.
Text version

Layer 1 transport: REST, MCP, A2A, and WebMCP for tools a page exposes to an agent in the browser (proposed, Chrome origin trial). Layer 2 identity and trust: Web Bot Auth, Visa TAP, Mastercard agent registration, KYA (announced, no spec), x401 (draft spec), OAuth 2.0 identity linking. Layer 3 shopping journey, agent to merchant: UCP, ACP, Poppy; PayPal Agent Ready is an integration for ACP and UCP. Layer 4 payment: AP2 mandates, Mastercard Agent Pay tokens, Visa TAP payment data, Amex Intent Intelligence (Intent ID and Proof of Intent Token), between agent, merchant and PSP; x402 and MPP for pay per request over HTTP 402 between client and server.

Specs and official pages: UCP (opens in new tab), ACP (opens in new tab), Personal Agent Protocol (opens in new tab), AP2 (opens in new tab), Visa Trusted Agent Protocol (opens in new tab), Mastercard Agent Pay (opens in new tab), Amex Intent Intelligence (Business Wire release by American Express) (opens in new tab), Amex ACE Developer Kit (opens in new tab), IETF Web Bot Auth working group (opens in new tab), x401 (opens in new tab), x402 (opens in new tab), MPP (opens in new tab), PayPal Agent Ready (opens in new tab), Model Context Protocol (opens in new tab), A2A (opens in new tab), WebMCP (opens in new tab). Web Bot Auth is an IETF working group draft and Amex Intent Intelligence is an issuer framework; neither is one of the 14 protocols on this page.

Journey protocols such as UCP (opens in new tab) and ACP (opens in new tab) ride on REST, MCP or A2A. AP2 is an extension for A2A and UCP (opens in new tab). Visa TAP signs agent requests (opens in new tab). x402 (opens in new tab) and MPP (opens in new tab) use HTTP 402.

2. Comparison matrix

One row per protocol. Values come from the official site and spec linked in the last column; n/a means no official source found.
ProtocolTransportAuthDiscoveryPayment modelVersionStatusLicenseRepoSource
UCPREST, JSON-RPC; AP2, A2A, MCP support built inOAuth 2.0 identity linking; AP2 payment mandatesBusiness profile advertising protocol version and capabilitiesAP2 mandates; payment handlers (e.g. Google Pay)Dated releases; latest 2026-08-25liveApache-2.0Universal-Commerce-Protocol/ucp (opens in new tab)site (opens in new tab) spec (opens in new tab)
ACPREST or MCPShared Payment Token (Stripe first compatible PSP)Discovery mechanisms still being worked onDelegated payment token; Stripe Shared Payment Token firstBetabetaApache 2.0agentic-commerce-protocol/agentic-commerce-protocol (opens in new tab)site (opens in new tab) spec (opens in new tab)
PoppyAPIs, conversations and web browsing in one sessionStandard OAuth sign-in with scopes; short-lived signed JWT session tokenpoppy.jsonNone yet (future extension)Draft 0.1 (draft 0.2 in progress)draftApache 2.0n/asite (opens in new tab) spec (opens in new tab)
AP2Extension for A2A and UCP; works alongside MCPSigned mandates (verifiable digital credentials), human present and not presentn/aPayment-method layer; cards first, push payments and digital currencies on roadmapv0.2, pre-releasedraftApache-2.0google-agentic-commerce/AP2 (opens in new tab)site (opens in new tab)
Visa TAPSignatures on agent HTTP requests per RFC 9421, aligned with Web Bot Auth; tags agent-browser-auth and agent-payer-auth; keys from Visa's directory.Merchant-specific, time-bound, non-replayable signaturesKey retrieval by merchantCard network (Visa Intelligent Commerce)Live in Europeliven/avisa/trusted-agent-protocol (opens in new tab)site (opens in new tab) spec (opens in new tab)
MC Agent PayWeb Bot Auth (RFC 9421) signatures.Tokenized card credentials for agentsn/aTokenized card credentialsRolling outbetan/an/asite (opens in new tab) spec (opens in new tab)
Know-Your-Agentn/aCross-network agent identification (planned)n/an/aNo spec yetannouncedn/an/asite (opens in new tab)
x401HTTP header fields PROOF-REQUEST, PROOF-RESPONSE and PROOF-RESULTVerifiable credentials via OpenID4VP over the W3C Digital Credentials API, described with DCQL; optional OAuth 2.0 exchange for an access tokenPer route: a protected resource answers with a PROOF-REQUEST headerNone; payment stays with HTTP 402 protocols such as x402Draft 0.2.0draftApache-2.0proof/x401 (opens in new tab)site (opens in new tab)
x402HTTP 402 Payment Required, client pays and retriesn/an/aPay per request over HTTP 402Protocol version 2liveApache-2.0x402-foundation/x402 (opens in new tab)site (opens in new tab)
MPPHTTP 402; HTTP, MCP/JSON-RPC and WebSocket transportsChallenge, Credential, ReceiptOpenAPI discovery documentPay per request, sessions, subscriptions over HTTP 402Core spec submitted to IETF as the Payment HTTP Authentication Scheme (draft-httpauth-payment-01, Sep 2026).liven/atempoxyz/mpp-specs (opens in new tab)site (opens in new tab) spec (opens in new tab)
PayPal ARn/aDelegated payment tokens through Braintree (ACP); Google Pay payment handler through Braintree or PayPal Orders v2 (UCP)n/aBraintree: delegated tokens (ACP), Google Pay handler (UCP)n/aliven/an/asite (opens in new tab)
MCPClient and server protocoln/an/an/an/aliveOpen sourcemodelcontextprotocol/modelcontextprotocol (opens in new tab)site (opens in new tab)
A2An/an/aAgent Cardn/a (AP2 extension)v1.0.1liveApache 2.0a2aproject/A2A (opens in new tab)site (opens in new tab)
WebMCPIn-page JavaScript (imperative API) or annotated HTML form elements (declarative API)Runs in the user's browser session; both APIs gated by the tools Permissions Policy (default self)Agents must visit the page to find its registered toolsn/a; checkout runs in the pageChrome origin trial from Chrome 149draftn/awebmachinelearning/webmcp (opens in new tab)site (opens in new tab)

3. What to implement for your stack

Pick the row that matches your stack.
If you runYou getYou implementSource
ShopifyGoogle AI Mode, Gemini, Copilot, ChatGPT via Agentic Storefronts. Since 13 Oct 2026 any agent or app can search Shopify Catalog and check out with Shop Pay through Shop MCP, which speaks UCP over MCP; shoppers can connect their own agent with the shop.md skillSettings in Shopify Adminshopify.com (opens in new tab), Shopify changelog (opens in new tab), shop.dev (opens in new tab), shop.md (opens in new tab)
StripeIntegrations for UCP or ACP; MPP or x402 for machine paymentsChosen Stripe integration (agent side in private preview)docs.stripe.com (opens in new tab)
BraintreeACP (ChatGPT), UCP (Google AI Mode, Gemini)PayPal Agent Readydeveloper.paypal.com (opens in new tab)
Custom commerce stackNothing out of the boxUCP capabilities plus OAuth 2.0 identity linking, and or ACP checkout endpoints (REST or MCP); optional Visa TAP signature verificationucp.dev (opens in new tab), agenticcommerce.dev (opens in new tab)
Paid API or contentn/ax402 or MPP middleware; MPP can also serve x402 clientsmpp.dev (opens in new tab)
AdyenAdyen Agentic: Agentic Feed, Agentic Cart, Agentic Payments (opens in new tab); supports ACP and UCP; compatible with Meta AI checkoutMerchant-scoped ACP token (opens in new tab) via /agentic_commerce/delegate_payment; single-use UCP token (opens in new tab), session requests signed with RFC 9421adyen.com (opens in new tab), MCP server (opens in new tab)
Salesforce Commerce CloudUCP for Google AI Mode and Gemini, GA in B2C Commerce 26.9+ (opens in new tab); ACP Instant Checkout integration with Stripe (opens in new tab)Enable UCP for your site (opens in new tab); business profile, checkout lifecycle, webhooksdeveloper.salesforce.com (opens in new tab)

4. Implementation

What you must expose, who builds it, and where to start. Paths and roles come from the linked official page; "no quickstart found" means we found only a spec or repo.
ProtocolExpose (endpoints, well-known files, keys)Who implementsOfficial start
UCP/.well-known/ucp business profile (versions, capabilities); catalog, cart, checkout and order capabilities; OAuth 2.0 metadata at /.well-known/oauth-authorization-server for identity linkingMerchant (or platform); PSP via payment handlergetting started (opens in new tab)
ACPAgent-facing checkout endpoints over REST or MCP; accept a delegated payment token (Stripe Shared Payment Token first)Merchant; PSP issues the token; agent platform callsStripe docs (opens in new tab)
Poppy/.well-known/poppy.json; OAuth metadata at /.well-known/oauth-authorization-server; APIs or company agentBusiness; personal agent signs inspec (no quickstart found) (opens in new tab)
AP2Issue and verify signed checkout and payment mandates (verifiable digital credentials)Agent, merchant and credential providerrepo and samples (no quickstart found) (opens in new tab)
Visa TAPRetrieve Visa keys, verify merchant-specific, time-bound agent signaturesMerchant verifies; onboarded agent signsspec (opens in new tab)
Mastercard Agent PayTokenized agent credentials; details not machine readableAgent platform and issuer; merchant via PSP (unverified)docs (no quickstart verified) (opens in new tab)
KYANothing: no specn/aannouncement only (opens in new tab)
x402Payment middleware: unpaid request returns HTTP 402, client pays and retriesSeller (API owner); buyer clientquickstart for sellers (opens in new tab)
MPPServer middleware (mppx); Challenge, Credential, Receipt; Payment-Receipt header; OpenAPI discoverySeller; agent client; Stripe or Temposerver quickstart (opens in new tab)
PayPal Agent ReadyBraintree integration; delegated tokens (ACP), Google Pay handler (UCP)Merchant on Braintree; PayPal as PSPoverview (opens in new tab)
MCPMCP server exposing tools and resourcesMerchant or vendor exposes; agent connectsbuild a server (opens in new tab)
A2AAgent Card at /.well-known/agent-card.json; A2A serverAgent owner (merchant or vendor)tutorials (opens in new tab)

This data is also a public MCP server and JSON API: see MCP.

5. Product data feeds

Identifiers, required fields and format per product data source. Every cell links to its official source.
SourceIdentifiersGTINRequired fieldsFormatAI surface
Google Merchant Center (opens in new tab)id, gtin (up to 10) (opens in new tab), mpn, brand, identifier_exists"It depends (strongly recommended if available)"; may be disapproved if an assigned GTIN is missing (opens in new tab); 8, 12, 13 or 14 digits, valid GS1 check digit, no 02/04/2 or 05/98/99 prefixesAlways: id title description link image_link availability price. When applicable: brand (new products), gtin or mpn, condition (used, refurbished), availability_date (preorder), shipping (21 countries incl. NL), apparel age_group gender color size, item_group_id (variants) (opens in new tab), is_bundle, multipackText, XML or Merchant API (opens in new tab)AI Mode, Gemini via UCP (opens in new tab); conversational attributes (opens in new tab)
OpenAI feed (opens in new tab)item_id, group_id, offer_id (opens in new tab), gtin, mpnOptional, one value, 8/12/13/14 digits with check digit; Google-compatible path: conditionally required (GTIN or MPN) (opens in new tab)item_id title description url brand seller_name image_url availability price; Google-compatible path (opens in new tab): id title description link image_link availability price brandFull snapshot via SFTP, at least daily (opens in new tab); parquet preferred, also jsonl.gz, csv.gz, tsv.gz; up to 500k items per shard; or the API for updates and promotions (opens in new tab)ChatGPT shopping discovery (US, approved partners) (opens in new tab); purchase on merchant site or app
Microsoft Merchant Center (opens in new tab)id, gtin (up to 10) (opens in new tab), mpn, brand, identifier_exists; Merchant Item ID for UCP (opens in new tab)Required if assigned by the manufacturer (opens in new tab)id title description link image_link price; shipping in AT and DE (opens in new tab)Feed file; Google feeds can be imported (opens in new tab)Copilot, Copilot Checkout (UCP-ready feed) (opens in new tab)
Schema.org (opens in new tab)gtin (opens in new tab), gtin8/12/13/14, mpn, sku, hasGS1DigitalLinkText or GS1 Digital Link URL; generalizes gtin8 to gtin14 (opens in new tab)None in the vocabulary; consumers set their own rulesJSON-LD, Microdata or RDFa on the pageAny crawler; no surface says it uses it as a checkout source

Schema.org 30.1 retail additions (opens in new tab) (2026-09-16)

  • Product: consumerNotice, isOftenBoughtWith, specification; Offer: itemPopularity; ShippingRateSettings: minimumOrderValue; MaximumRetailPrice.
  • EU Digital Product Passport: DigitalProductPassport, hasDigitalProductPassport, recycledContentPercentage, substanceOfConcern.

Interpretation, not a source claim: isOftenBoughtWith and itemPopularity resemble Merchant Center's related_product and popularity_rank. Who proposed them is unverified. Microsoft's January 2026 post (opens in new tab) said MMC was not required for Copilot Checkout; the current agentic commerce page (opens in new tab) says it is. We follow the current page.

UTM tagging per surface

Convention (from vreeman.com/utm (opens in new tab)): all values lowercase; required: utm_source and utm_medium; optional: utm_campaign, utm_term, utm_content, utm_source_platform, utm_creative_format and utm_marketing_tactic; append with & if the URL already has parameters; check the tagged URL returns 200. For AI assistants pick a per-assistant source (chatgpt.com, gemini, perplexity, copilot, claude) and choose the medium yourself (not referral). The templates use {ai_medium} as a placeholder. Option A: utm_medium=ai-assistant lands in GA4's built-in AI Assistant default channel (opens in new tab) with no setup. Option B: your own medium (for example ai) plus a GA4 custom channel group placed above Referral; without that group the traffic lands in Unassigned. Organic and cpc media map into GA4 Default Channel Groups either way. A campaign name containing "shopping" is meant to qualify for GA4 Organic Shopping or Paid Shopping per Google's channel rules; verify in your own property.

UTM templates per surface. Required: utm_source, utm_medium. Optional: the rest. Replace {ai_medium} with your choice (Option A or B above). All lowercase; append with & when the URL already has a query string. Templates follow Simon Vreeman's UTM convention (opens in new tab); the Official column quotes the platform.
SurfaceRequiredOptional (examples)Official ruleNote
OpenAI feed url?utm_source=chatgpt.com&utm_medium={ai_medium}&utm_campaign=chatgpt-shopping&utm_content={item_id}&utm_source_platform=openaiOfficial: url is required and must be the product page with the variant selected (opens in new tab), kept stable. The spec neither allows nor forbids extra query parameters.Use the same utm_source value OpenAI reportedly appends (chatgpt.com), so a second tag cannot split your source. Keep the values static per item so the URL stays stable.
Google Merchant Center link (free listings)?utm_source=google&utm_medium=organic&utm_campaign=shopping-free-listings&utm_content={id}Official: link is required, must use your verified domain and an RFC 2396 or 1738 encoded URL. Google's own example contains query parameters (opens in new tab).Only when the same link is not also used for Shopping ads; otherwise ads clicks are labelled organic.
Google ads_redirect (Shopping ads)?utm_source=google&utm_medium=cpc&utm_campaign={campaign}-shopping&utm_content={id}Official: optional, "a URL used to specify additional parameters for your product page"; it replaces link for ads clicks (opens in new tab) and must be on the same registered domain.With Google Ads auto-tagging on, the gclid normally decides attribution in a linked GA4 property, so treat these UTMs as a fallback (assumption, not checked in Google Ads docs).
Microsoft Merchant Center ads_redirect?utm_source=bing&utm_medium=cpc&utm_campaign={campaign}-shopping&utm_content={id}Official: link must be a direct URL with no redirects; ads_redirect overrides it (opens in new tab) and must resolve to the same URL as link "after any parameters or tracking templates are replaced".Keep link clean or tagged as for Google; put the cpc tags in ads_redirect.
UCP or ACP hand off URL to your site?utm_source={agent}&utm_medium={ai_medium}&utm_campaign=agentic-checkout&utm_content={item_id}No official UCP or ACP text on UTM tagging found. Checkout runs over the protocol API, so a page visit only happens when the agent sends the buyer to your site.Recommendation only: tag any URL you return for that hand off, with {agent} as a lowercase host such as gemini.google.com. Not verified per surface.

If you pick Option B (own medium): create a GA4 custom channel group with an AI assistants channel: Medium exactly matches your chosen value (for example ai) OR Session source matches chatgpt\.com|gemini\.google\.com|perplexity\.ai|copilot\.microsoft\.com|claude\.ai. Place it above Referral. Without it, that medium lands in Unassigned in the default channel group. Option A (ai-assistant) needs no custom group (opens in new tab).

Referrer segments (complement): the same source regex catches untagged visits. These hostnames are the public addresses of each assistant; that they appear as referrers is observed or assumed, not documented by the vendors. Referrers are often stripped by apps, so expect undercounting.

6. Protocols

UCP Universal Commerce Protocol

Covers almost the whole journey: an AI surface finds your shop, reads your catalog, builds a cart, checks out and handles the order afterwards, while you stay merchant of record. Open standard co-developed by Google, Shopify and others.

journey stages
  • 1Discovery
  • 2Product data
  • 3Cart and checkout
  • 4Payment
  • 5Trust and identity
  • 6Post-purchase
backers
Co-developed by Google, Shopify, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe (ucp.dev)
status
live Live in the US: UCP checkout via Google Universal Cart (AI Mode in Search and the Gemini app) since 15 Oct 2026, with Google Pay checkout or handoff to the merchant cart, merchant stays seller of record; Lodging draft specification available (not yet in a release); Food coming soon; Shopify Shop MCP (UCP over MCP) open to any agent since 13 Oct 2026; Shopify Checkout MCP and Cart MCP support the UCP buyer consent extension since 16 Oct 2026 (source (opens in new tab))
version
Dated releases; latest 2026-08-25
transport
REST, JSON-RPC; AP2, A2A, MCP support built in
auth
OAuth 2.0 identity linking; AP2 payment mandates
discovery
Business profile advertising protocol version and capabilities
payment
AP2 mandates; payment handlers (e.g. Google Pay)
license
Apache-2.0
sdks
Spec, SDKs and reference implementations on GitHub
implement
Expose catalog, cart, checkout and order capabilities per the spec
links
site (opens in new tab) | spec (opens in new tab) | repo (opens in new tab) | announcement 2026-01-11 (opens in new tab) | changelog 2026-08-25 (opens in new tab)

Implementation notes

Open questions

  • Deprecation schedule is left to each business.

ACP Agentic Commerce Protocol

Sits at product data, cart and checkout: lets an agent such as ChatGPT buy from you with payment credentials passed securely, while you stay merchant of record. Maintained by OpenAI and Stripe, per the ACP repo; Stripe's docs say it was created by Stripe, OpenAI and Meta.

journey stages
  • 2Product data
  • 3Cart and checkout
  • 4Payment
backers
OpenAI, Stripe (maintainers, per the ACP repo)
status
beta Beta; OpenAI says it is moving away from a standalone Instant Checkout experience (March 2026); purchases complete on merchant sites or apps (source (opens in new tab))
version
Beta
transport
REST or MCP
auth
Shared Payment Token (Stripe first compatible PSP)
discovery
Discovery mechanisms still being worked on
payment
Delegated payment token; Stripe Shared Payment Token first
license
Apache 2.0
sdks
Spec on GitHub; Stripe docs
implement
Agent-facing checkout endpoints on your commerce backend and PSP
links
site (opens in new tab) | spec (opens in new tab) | repo (opens in new tab) | announcement 2025-09-29 (opens in new tab) | changelog 2026-04-17 (opens in new tab)

Implementation notes

Open questions

Poppy Personal Agent Protocol

Sits before the purchase: a person's own AI agent finds your business, signs in to their account with you and acts on their behalf. Draft from Sierra and Meta, no payments yet.

journey stages
  • 1Discovery
  • 5Trust and identity
backers
Sierra, Meta (+ Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, Walmart; 35 design partners including OpenAI)
status
draft Draft 0.1 published 9 Oct 2026; draft 0.2 in progress with breaking changes (source (opens in new tab))
version
Draft 0.1 (draft 0.2 in progress)
transport
APIs, conversations and web browsing in one session
auth
Standard OAuth sign-in with scopes; short-lived signed JWT session token
discovery
poppy.json
payment
None yet (future extension)
license
Apache 2.0
sdks
Reference implementation announced, not yet published
implement
Publish poppy.json and OAuth metadata, expose APIs or a company agent
links
site (opens in new tab) | spec (opens in new tab) | announcement 2026-10-06 (opens in new tab) | changelog 2026-10-09 (opens in new tab)

Implementation notes

Open questions

  • Payments not covered.
  • No public GitHub repo found.

AP2 Agent Payments Protocol

Sits at payment: gives you signed proof that the shopper really authorized the agent to pay. Created by Google, now being standardized in the FIDO Alliance.

journey stages
  • 4Payment
backers
Google, now FIDO Alliance
status
draft Pre-release spec, not a live network
version
v0.2, pre-release
transport
Extension for A2A and UCP; works alongside MCP
auth
Signed mandates (verifiable digital credentials), human present and not present
discovery
n/a
payment
Payment-method layer; cards first, push payments and digital currencies on roadmap
license
Apache-2.0
sdks
Spec, docs, SDK and samples on GitHub
implement
Issue and verify checkout and payment mandates
links
site (opens in new tab) | repo (opens in new tab) | announcement 2025-09-16 (opens in new tab) | changelog 2026-04-28 (opens in new tab)

Implementation notes

Open questions

  • Standardization continuing in FIDO working groups.

Visa TAP Trusted Agent Protocol

Sits at trust: lets your site recognize a trusted Visa shopping agent and tell it apart from a malicious bot while it browses, and can carry consumer and payment details at checkout.

journey stages
  • 4Payment
  • 5Trust and identity
backers
Visa
status
live Live in Europe since July 2026 with participating merchants and over 30 issuers; spec and sample code public.
version
Live in Europe
transport
Signatures on agent HTTP requests per RFC 9421, aligned with Web Bot Auth; tags agent-browser-auth and agent-payer-auth; keys from Visa's directory.
auth
Merchant-specific, time-bound, non-replayable signatures
discovery
Key retrieval by merchant
payment
Card network (Visa Intelligent Commerce)
license
n/a
sdks
Sample implementation on GitHub
implement
Retrieve keys and verify agent signatures
links
site (opens in new tab) | spec (opens in new tab) | repo (opens in new tab) | announcement 2025-10-14 (opens in new tab) | changelog 2026-07-02 (opens in new tab)

Implementation notes

Open questions

  • Agent signature generation documented only for onboarded agents; no public step-by-step onboarding guide.

MC Agent Pay Mastercard Agent Pay

Sits at payment: a registered agent pays with a tokenized Mastercard credential instead of a raw card number. Agent Pay for Machines extends this to micro-payments. Agents are credentialed with Mastercard Verifiable Intent so they can be recognized across ecosystems. Since 30 September 2026, trust and intelligence services add a probability score that a transaction was initiated by an AI agent, in testing in the US.

journey stages
  • 4Payment
  • 5Trust and identity
backers
Mastercard
status
beta Rolling out; Agent Pay for Machines launched June 2026; Agent Pay Trust Framework intelligence layer announced 30 Sep 2026, with an AI-agent probability score in US testing (source (opens in new tab))
version
Rolling out
transport
Web Bot Auth (RFC 9421) signatures.
auth
Tokenized card credentials for agents
discovery
n/a
payment
Tokenized card credentials
license
n/a
sdks
Mastercard developer docs
implement
Recognize registered agents via Web Bot Auth at your CDN; accept agentic tokens in existing card fields. No public self-service agent registration.
links
site (opens in new tab) | spec (opens in new tab) | announcement 2025-04-29 (opens in new tab) | changelog 2026-09-30 (opens in new tab)

Implementation notes

Open questions

  • No public self-service agent registration.

Know-Your-Agent Know-Your-Agent (KYA) interoperability framework

Will sit at trust: Visa, Mastercard and Ant International will explore common principles, building on the SAFR framework, via BuildFin.ai; each has its own protocol (TAP, Verifiable Intent, Agentic Mobile Protocol). Announced 10 September 2026, no spec yet.

journey stages
  • 5Trust and identity
backers
Visa, Mastercard, Ant International
status
announced Announced, no spec yet
version
No spec yet
transport
n/a
auth
Cross-network agent identification (planned)
discovery
n/a
payment
n/a
license
n/a
sdks
n/a
implement
Nothing yet
links
site (opens in new tab) | announcement 2026-09-10 (opens in new tab)

Implementation notes

Open questions

  • No spec published.

x401 x401: HTTP Proof Requirement Protocol

Sits at trust: a site or API answers an agent request with a PROOF-REQUEST header, and the agent returns a verifiable credential (OpenID4VP over the W3C Digital Credentials API) proving who authorized it before access is granted. Payment stays with HTTP 402 protocols such as x402. Proof says it plans to submit x401 to the FIDO Alliance: "Proof will submit x401 to the FIDO Alliance's agentic authentication standards workgroup." (launch release, 25 Jun 2026).

journey stages
  • 5Trust and identity
backers
Proof; Circle (co-endorser)
status
draft Draft spec v0.2.0, open (Apache-2.0); launched 25 Jun 2026
version
Draft 0.2.0
transport
HTTP header fields PROOF-REQUEST, PROOF-RESPONSE and PROOF-RESULT
auth
Verifiable credentials via OpenID4VP over the W3C Digital Credentials API, described with DCQL; optional OAuth 2.0 exchange for an access token
discovery
Per route: a protected resource answers with a PROOF-REQUEST header
payment
None; payment stays with HTTP 402 protocols such as x402
license
Apache-2.0
sdks
Spec on GitHub
implement
Send a PROOF-REQUEST on protected routes and verify the credential result the agent returns; handle payment separately with HTTP 402
links
site (opens in new tab) | repo (opens in new tab) | announcement 2026-06-25 (opens in new tab)

Implementation notes

Open questions

  • Draft spec; Proof says it will submit x401 to a FIDO Alliance workgroup.

x402 x402

Sits at payment for pay per request: your server answers an unpaid request with HTTP 402, the agent pays and retries. Built for small automated payments rather than a classic cart.

journey stages
  • 4Payment
backers
x402 Foundation
status
live Live; about $24M volume and 75M transactions in the last 30 days per x402.org (live counter, read 2026-10-12)
version
Protocol version 2
transport
HTTP 402 Payment Required, client pays and retries
auth
n/a
discovery
n/a
payment
Pay per request over HTTP 402
license
Apache-2.0
sdks
Middleware on GitHub
implement
Payment middleware on routes
links
site (opens in new tab) | repo (opens in new tab) | announcement 2025-05-06 (opens in new tab) | changelog (opens in new tab)

Implementation notes

MPP Machine Payments Protocol

Sits at payment for machine to machine purchases over HTTP 402. Payment methods per mpp.dev: Tempo stablecoins, Stripe, cards via encrypted network tokens, Bitcoin over Lightning, EVM, Solana, Stellar, XRPL, Monad, NEAR Intents, RedotPay, or custom; plus sessions and subscriptions. From Stripe and Tempo.

journey stages
  • 4Payment
backers
Stripe, Tempo
status
live Live since March 2026
version
Core spec submitted to IETF as the Payment HTTP Authentication Scheme (draft-httpauth-payment-01, Sep 2026).
transport
HTTP 402; HTTP, MCP/JSON-RPC and WebSocket transports
auth
Challenge, Credential, Receipt
discovery
OpenAPI discovery document
payment
Pay per request, sessions, subscriptions over HTTP 402
license
n/a
sdks
TypeScript, Python, Rust, Go, Ruby
implement
mppx server middleware
links
site (opens in new tab) | spec (opens in new tab) | repo (opens in new tab) | announcement 2026-03-18 (opens in new tab) | changelog 2026-10-05 (opens in new tab)

Implementation notes

Open questions

  • License not verified.

PayPal AR PayPal Agent Ready

Sits at checkout and payment: a PayPal or Braintree integration makes your checkout available to agents in ChatGPT (ACP, via Braintree) and Google AI Mode and Gemini (UCP, via Braintree or PayPal Orders v2). An integration, not a protocol.

journey stages
  • 3Cart and checkout
  • 4Payment
backers
PayPal, Braintree
status
live Developer docs live
version
n/a
transport
n/a
auth
Delegated payment tokens through Braintree (ACP); Google Pay payment handler through Braintree or PayPal Orders v2 (UCP)
discovery
n/a
payment
Braintree: delegated tokens (ACP), Google Pay handler (UCP)
license
n/a
sdks
PayPal developer docs
implement
Braintree integration (ACP and UCP) or PayPal Orders v2 API (UCP)
links
site (opens in new tab) | announcement 2025-10-28 (opens in new tab)

Implementation notes

MCP Model Context Protocol

Not a journey stage but plumbing: connects AI apps to your tools and data. UCP and ACP can both run over it.

journey stages
  • Transport, not a stage
backers
Created by Anthropic; now hosted by the Agentic AI Foundation (Linux Foundation)
status
live Stable, widely used
version
n/a
transport
Client and server protocol
auth
n/a
discovery
n/a
payment
n/a
license
Open source
sdks
SDKs and spec on GitHub
implement
Build an MCP server exposing your data and tools
links
site (opens in new tab) | repo (opens in new tab) | announcement 2024-11-25 (opens in new tab) | changelog 2026-07-28 (opens in new tab)

Implementation notes

Open questions

  • Governance body not stated on modelcontextprotocol.io.

A2A Agent2Agent Protocol

Not a journey stage but plumbing between agents from different vendors, for example a shopper's agent and your shop's agent. Originally from Google, now at the Linux Foundation.

journey stages
  • Transport, not a stage
backers
Google, now Linux Foundation (Agentic AI Foundation)
status
live Stable, widely used
version
v1.0.1
transport
n/a
auth
n/a
discovery
Agent Card
payment
n/a (AP2 extension)
license
Apache 2.0
sdks
Official SDKs: Python, Go, Java, JavaScript, C#/.NET, Rust.
implement
Publish an Agent Card, implement A2A server
links
site (opens in new tab) | repo (opens in new tab) | announcement 2025-04-09 (opens in new tab) | changelog 2026-05-28 (opens in new tab)

Implementation notes

WebMCP WebMCP

Sits in the browser at cart and checkout: a web page registers structured tools, such as checkout, that an AI agent in the user's browser can call, via JavaScript (imperative API) or annotated HTML forms (declarative API). A proposed web standard in a Chrome origin trial, primarily designed for local browser workflows with a human in the loop.

journey stages
  • 3Cart and checkout
backers
Google Chrome
status
draft Proposed web standard (Chrome origin trial from Chrome 149) that lets a page expose structured tools such as checkout to in-browser AI agents via JavaScript or annotated HTML forms. Subject to change. Shopify checkout supports it since 28 Sep 2026. (source (opens in new tab))
version
Chrome origin trial from Chrome 149
transport
In-page JavaScript (imperative API) or annotated HTML form elements (declarative API)
auth
Runs in the user's browser session; both APIs gated by the tools Permissions Policy (default self)
discovery
Agents must visit the page to find its registered tools
payment
n/a; checkout runs in the page
license
n/a
sdks
Chrome docs and demos (GoogleChromeLabs/webmcp-tools)
implement
Register tools with JSON Schemas for actions such as checkout or filters; join the origin trial
links
site (opens in new tab) | repo (opens in new tab) | announcement 2026-05-18 (opens in new tab) | changelog 2026-10-07 (opens in new tab)

Implementation notes

Open questions

  • Under active discussion and subject to change, per Chrome.

7. What to watch

8. FAQ

What is the difference between UCP and ACP?

UCP covers the whole journey (opens in new tab) (discovery via /.well-known/ucp, catalog, cart, checkout, orders) and is negotiated over REST, MCP or A2A. ACP (opens in new tab) is the spec created by Stripe, OpenAI and Meta (opens in new tab); in ChatGPT it now mainly carries product feeds (opens in new tab), while checkout runs on the merchant side.

How does an agent discover a UCP merchant?

The business publishes its profile at /.well-known/ucp (opens in new tab). The platform fetches it, and the server selects the version and capabilities from the intersection of both profiles.

Where does AP2 fit next to UCP?

AP2 (opens in new tab) proves the user authorised a purchase with signed mandates. In UCP it is an optional extension (dev.ucp.shopping.ap2_mandate) that is only active when both business and platform advertise it (opens in new tab).

Do I need to build checkout endpoints for ChatGPT?

Not for discovery. ChatGPT reads your product feed and sends buyers to your own checkout (opens in new tab); a ChatGPT app is optional (opens in new tab) for merchants who want a deeper integration.

Is MCP or A2A a commerce protocol?

No. MCP connects an agent to tools and data (opens in new tab), A2A connects agents to each other (opens in new tab). UCP and ACP can use them as transports (opens in new tab).

Changes

  • 12 Oct 2026: Public MCP server at vreeman.ai/commerce/mcp and a site audit (also at /commerce/api/audit). New Access items for AI crawlers and agents in robots.txt, Merchant Center crawlers and Cloudflare AI bot policies. The ChatGPT UTM guidance no longer relies on an OpenAI Help article: shops tag their own feed URLs and segment on the referrer.
  • 12 Oct 2026: AI medium is a shop choice: templates use {ai_medium}. Option A utm_medium=ai-assistant (GA4 built-in AI Assistant channel); Option B own medium (e.g. ai) plus custom channel group above Referral, else Unassigned. Conversational attributes remain Optional.
  • 12 Oct 2026: Earlier pass prescribed utm_medium=ai; superseded by the neutral choice above.
  • 12 Oct 2026: UTM guidance aligned with vreeman.com/utm: required utm_source and utm_medium only; campaign, content and other params optional. Referrer regex escaping fixed on Business.
  • 12 Oct 2026: Added UTM tagging per surface (Simon Vreeman convention) and referrer segments.
  • 12 Oct 2026: ChatGPT corrected to discovery only, based on OpenAI's own announcement (opens in new tab); analytics tagging added; FAQ added.
  • 12 Oct 2026: Product data layer and Implementation section added.

Last checked: