Home › Guides › Agentic commerce
Tech Explained · 2026Agentic Commerce in 2026: How AP2 Works, AP2 vs ACP, and 6 Steps to Ship Agent Payments
Agentic commerce is online buying where an AI agent, not a person, completes the checkout, with cryptographic proof that the user authorised it. Google's Agent Payments Protocol encodes that proof in 3 signed mandates: intent, cart and payment. Google donated AP2 to the FIDO Alliance on 28 April 2026. Settlement still runs over existing cards, bank rails or UPI.
- The hard problem is proof, not payment. Card rails cannot tell a merchant whether the thing at checkout is a human, a helpful agent, or a bot spending someone else's money.
- Three signed mandates answer it. Intent carries scope and limits, Cart pins the items and total, Payment is the stripped-down record the network sees.
- AP2 and ACP are not rivals. ACP is the merchant-side checkout contract. AP2 is the authorisation layer around it.
- India is building its own rail. NPCI is reportedly developing a Unified Agent Protocol on UPI Circle and Reserve Pay, pending RBI sign-off.
- The skill that gets hired is boring. Scoped delegation, server-side limit checks, idempotency, a readable audit trail. Not prompt writing.
Picture a four-person platform team at a mid-size Indian grocery retailer. They ship a reorder agent that reads purchase history, notices the atta is running low, and offers to buy it. It demos beautifully. Then legal asks one question: when this thing buys the wrong brand at 2am, what do you show the customer, the bank and the merchant to prove what was authorised? Nobody has an answer, and the project stalls. That question, not model quality, is what these protocols exist to settle.
What Agentic Commerce Actually Means in 2026
Strip the marketing away and agentic commerce is a delegation problem wearing a shopping cart. A user hands an AI agent a budget and a goal, and money moves. Every hard part sits between "the user wanted groceries" and "this card was charged Rs 1,240 for these SKUs".
Traditional e-commerce never had to close it, because the human was at checkout clicking a button and typing an OTP. Fraud systems assume that. An agent breaks it twice over: the session looks automated, and the decision happened minutes or days before the charge. So the protocols that matter are not payment protocols. They are authorisation and evidence protocols that end in a payment.
Agentic commerce at a glance
Four facts to have in hand before you read a vendor pitch.
AP2 and ACP dates from FIDO Alliance and Stripe announcements; UPI Circle limits per September 2026 reporting. Checked 29 October 2026.
How the AP2 Protocol Works: Three Mandates, Three Audiences
The AP2 protocol (Agent Payments Protocol) was announced by Google in September 2025 and contributed to the FIDO Alliance on 28 April 2026, when the Alliance announced an Agentic Authentication Technical Working Group drawing on Google's AP2 and Mastercard's Verifiable Intent. The v0.2 release that day added human-not-present payments. Everything in AP2 is a verifiable credential it calls a mandate, and each exists for a different audience. That split is what makes it work.
The AP2 mandate chain
Each hop adds a signature, and each audience sees only what it needs.
Structure per the AP2 specification and its reference implementation. Checked 29 October 2026.
| Mandate | What it contains | Who signs | Who reads |
|---|---|---|---|
| Intent | Max price, item spec, allowed merchants, expiry or TTL | User's wallet key | Agent, plus merchant if user absent |
| Cart | Exact line items, quantities, final total | Merchant signs, user co-signs | Merchant and dispute process |
| Payment | Hashed cart reference, amount, human-present flag | Derived from cart or intent | Issuer and payment network |
The network does not need your grocery list and the merchant does not need your card number. If you have shipped delegated authorisation, the shape is familiar: an Intent Mandate does what an OAuth scope does, with a price ceiling and a clock bolted on. The difference is non-repudiation. A signature proves the user agreed to those limits; an access token never did. Writing tool contracts that precisely is what the CCDV-F developer certification tests.
AP2 vs ACP vs x402: Which Protocol Does What
The common mistake is treating these as options you pick between. They sit at different layers, so AP2 vs ACP is not a bake-off: in most builds you implement one and reference the other.
| Criterion | AP2 | ACP | x402 |
|---|---|---|---|
| Layer it owns | Authorisation and evidence | Merchant checkout contract | Per-request machine payments |
| Core artefact | Three signed mandates | REST checkout session plus a scoped payment token | A 402 response with payment terms |
| Merchant of record | Unchanged by the protocol | The merchant, explicitly | The API provider |
| Settlement rails | Cards, bank transfer, UPI, stablecoins | Cards via a scoped vault token | Typically stablecoins |
| Human not present | Yes, added in v0.2 | Agent-initiated by design | Fully machine to machine |
| Best fit | Proving an agent was allowed to buy | Agent checkout on your store | Paying per API call |
Where ACP sits
ACP launched on 29 September 2025, co-developed by OpenAI and Stripe under Apache 2.0, and its latest stable release is dated 17 April 2026, adding cart, feed, orders and authentication surfaces plus Model Context Protocol compatibility. A merchant exposes REST checkout-session endpoints and accepts a scoped payment token at completion, which Stripe calls a Shared Payment Token, so the agent never touches card details. The honest read: ACP tells your store how to accept an agent's order, AP2 tells everyone downstream why it was legitimate. Our grocery team needs both.
Also read: A2A vs MCP, and how agents talk to each other, on the transport layer these commerce protocols ride.
Agentic Commerce in India: UPI Circle, Reserve Pay and the NPCI Agent Registry
India is not waiting for a Western standard, and if you build for Indian customers this is what will constrain you. September 2026 coverage, largely sourced to Reuters, reported NPCI is developing a Unified Agent Protocol letting customers authorise agents to transact within predefined limits without approving each transaction. NPCI has published no specifications and reportedly needs Reserve Bank of India approval first, so read the numbers below as today's rail, not the final rule.
| Rail | What it does today | Reported limit | Why your agent build cares |
|---|---|---|---|
| UPI Circle, full delegation | Primary user delegates payment authority to a secondary user | Rs 5,000 per transaction, Rs 15,000 per month | Closest existing analogue to an Intent Mandate, and the first cap you will hit |
| UPI Circle, partial delegation | Secondary user initiates, primary approves | Set by the primary user | Maps onto a human-in-the-loop approval queue |
| Reserve Pay | Blocks funds for multiple future debits | Up to Rs 10,000 held for 90 days | Gives an agent a funded envelope instead of a live card |
| Agent registry (planned) | Verifies and monitors agents on UPI | Not published | Your agent will likely need an identity in it to transact |
The Rs 15,000 monthly ceiling makes the design question concrete: a reorder agent fits inside it, an agent buying a laptop does not. The registry is the piece worth watching, because an agent identity issued by a national payment body centralises revocation. Read it alongside DPDP obligations, since a registered agent acting on purchase history touches both regimes at once. Mapping controls like that onto a live deployment is what our Forward Deployed Engineer course runs as labs.
Also read: The DPDP Act for AI agents and AI agent identity vs service accounts.
Where Agentic Commerce Actually Pays Off Right Now
Most demos are a shopping chatbot, the least interesting version of this. The cases that survive a cost review share one trait: the decision is repetitive and low-value, so the human was never adding judgement. Four hold up.
- Replenishment. Consumables on a known cadence, like the grocery reorder agent, which fits inside the Rs 15,000 monthly ceiling.
- Procurement under a threshold. Buying approved SaaS seats or spares below a Rs 25,000 approval line, vendor allow-list in the Intent Mandate.
- Metered machine spending. Paying per API call or inference, the x402 shape rather than the AP2 one.
- Conditional buys. Purchase when a price crosses a threshold, exactly what an expiring Intent Mandate was built to express.
Notice what is missing: taste, negotiation, or a return the customer will be emotional about. Drawing that boundary is the core skill the CCAR-F architect foundations track assesses.
How to Get Started: A 6-Step Build Plan
You do not need the whole protocol to learn this. You need one narrow purchase flow with real signatures in it, built in this order.
Six steps to a working agent payment flow
About six weeks of evenings for one engineer who already ships APIs.
Write the limits as data, not prose
Express one purchase's constraints as JSON: max price, merchant IDs, SKU pattern, expiry. Deliverable is a schema, not a prompt.
Sign it, then break it
Sign the constraint object, write a verifier. Deliverable is a test proving a mutated price cap gets rejected.
Build the merchant cart endpoint
Take an intent, return a priced cart, sign it, following the ACP checkout-session shape. Deliverable is a replayable signed cart.
Re-check the limits server side
Verify the cart against the intent constraints on your server, never the agent's own check. Deliverable is a cart rejected for busting the cap by Rs 1.
Charge in a sandbox with an idempotency key
Derive the key from the cart hash, fire the same request five times. Deliverable is one charge, four no-ops.
Make the audit trail readable
Render the mandate chain as a plain-language timeline. Deliverable is a page support can paste into a dispute reply unaided.
Build order derived from the AP2 mandate structure and ACP checkout-session surface. Checked 29 October 2026.
Step 6 is the one engineers skip and the one that decides whether this ships. The protocol's value is evidence, and evidence nobody can read is not evidence. Building flows end to end like this is the spine of the live AI Engineer course.
Agent payments reward builders, not prompt writers. Learn to build the agent.
Build agents that plan, use tools and act, certified on both Microsoft Copilot Studio and Claude Code, the two stacks real job postings are naming. Scoped tool design, RAG and guardrails as hands-on labs.
Explore the course
What Usually Goes Wrong Here
Four things a colleague would warn you about over a desk, none of them in the spec.
Four failures we would bet on
Each one has killed an agent payment pilot that technically worked.
Your catalogue is the real blocker
These protocols all assume accurate upstream product data and none validate it. Inconsistent SKU titles mean the agent buys the wrong atta, and the mandate faithfully proves you authorised it.
Data qualityNobody owns the refund path
Teams design the buy and forget the unbuy. Decide who initiates a return and which mandate justifies the refund before writing the charge code.
OperationsRetries become double charges
An agent that times out and retries is a duplicate payment generator. Derive the idempotency key from the signed cart hash, never a timestamp or an ID the agent picks.
EngineeringLiability is genuinely unsettled
Reporting on NPCI's plans is explicit that liability for wrong or unauthorised agent payments is unresolved. Do not let a vendor deck imply otherwise.
RiskFrom documented protocol gaps and September 2026 reporting on NPCI's plans. Checked 29 October 2026.
Agentic commerce is oversold right now, and the evidence is the first flagship product built on it. ChatGPT's Instant Checkout, the launch showcase for ACP, was wound down in spring 2026 after roughly five months; reporting attributed it to very low sales, and one account put live Shopify merchants inside it at around 30 by March 2026. The protocol was not the problem. Demand was.
So learn the delegation and audit patterns, which transfer to every agent you deploy. Do not stake a career move on agent shopping volumes arriving in 2027.
Is Agentic Commerce Worth Learning in 2026?
Yes, as a skills bet rather than a product bet. Scoped delegation, signature verification, idempotency, server-side constraint enforcement and a readable audit trail are the controls every regulated agent deployment needs, payments or not.
Take a 2019 Java developer moving into AI. Six weeks of evenings on the flow above leaves them something far more hireable than another RAG chatbot: an agent that was allowed to spend money and provably stayed inside its limits. That lands in a Bengaluru fintech interview.
Pair it with agent identity and access control, which Copilot and agent administration covers, and production tracing in the MLOps engineer track. The certifications overview maps exam to layer; the free webinars let you sit in first.
Related guides
- How OAuth 2.0 works: PKCE and token validation because an Intent Mandate is a scope with a price cap.
- Human-in-the-loop AI agents and approval queues maps onto UPI Circle partial delegation.
- Microsoft Agent 365 and the agent control plane shows what a vendor agent registry looks like.
- Highest paying AI jobs in India 2026 for where agent engineering sits on pay.
- AI engineer jobs in Hyderabad 2026 because GCC and fintech employers there hire for this work.
Frequently asked questions
What is agentic commerce in simple terms?
Agentic commerce is online buying where an AI agent completes the purchase instead of a person clicking checkout. Because no human is present at payment, these systems add signed proof of what was authorised: a scope, a price limit, an expiry and the exact cart.
What is the AP2 protocol and who controls it now?
AP2, the Agent Payments Protocol, was announced by Google in September 2025 and contributed to the FIDO Alliance on 28 April 2026, when FIDO announced an Agentic Authentication Technical Working Group drawing on AP2 and Mastercard's Verifiable Intent. It now moves through FIDO's standards process.
Is AP2 the same as the Agentic Commerce Protocol?
No, and they are not really alternatives. ACP, from OpenAI and Stripe under Apache 2.0, defines the merchant-side checkout surface: session endpoints and a scoped payment token. AP2 defines the authorisation evidence, so a merchant can implement ACP and still want AP2 mandates for disputes.
Can AI agents make UPI payments in India yet?
Not under a national framework yet. September 2026 reports say NPCI is developing a Unified Agent Protocol on UPI Circle and Reserve Pay, plus an agent registry, pending RBI approval. Today you work within UPI Circle full delegation, reported at Rs 5,000 per transaction and Rs 15,000 per month, or a vendor route such as Pine Labs P3P.
Who is liable if an AI agent buys the wrong thing?
Unsettled, and you should design assuming that. Reporting on NPCI's plans notes liability for wrong or unauthorised agent payments is unresolved. Keep envelopes small, require fresh approval above a threshold, and keep the mandate chain readable.
Is agentic commerce worth learning in 2026 or is it too early?
Worth learning as a skill, not a market bet. Consumer demand is thin, and the first flagship product on ACP, ChatGPT Instant Checkout, was wound down in spring 2026. The delegation, limit-enforcement and audit patterns apply to every production agent regardless of how fast agent shopping grows.
In your position we would spend six weeks building the flow above and treat agentic commerce as the excuse, not the destination. The protocols will move; AP2 is at v0.2 under committee governance. What will not change is that every enterprise agent worth deploying needs scoped authority, a server-side limit check and an audit trail a human can read, and almost nobody builds those well yet. That is the gap worth standing in, and the AI Engineer course teaches it live over 16 weeks.
About this guide. 360 Digital Transformation is an Anthropic Partner and a Microsoft Authorized Training Partner. Other certification bodies, vendors and employers named here are not affiliated with us. Product features and pricing change often; figures cited were checked on 29 October 2026.
Python
Claude API
FAISS
ChromaDB
LangChain
LangGraph
CrewAI
AutoGen (AG2)
