Agent Payments Protocol (AP2)

The Agent Payments Protocol (AP2) is an open specification for securing payments that AI agents make on a user's behalf. It answers the question every merchant and bank faces when an agent shows up to buy something: did a real person authorize this purchase, at this price, within these limits? AP2 answers it with mandates, cryptographically signed records of what the user approved, which travel with the transaction and can be checked later in a dispute.

Google introduced AP2 in September 2025. On April 28, 2026 it released version 0.2 and donated the protocol to the FIDO Alliance, the standards body behind passkeys, to keep it vendor-neutral (Google). The spec and SDKs live on GitHub.

Version 0.2 defines five roles: the shopping agent, the credential provider (the source of the payment credential, such as a wallet or card issuer), the merchant, the merchant's payment processor, and a trusted surface. The trusted surface is the user interface that collects the person's informed consent, and the spec requires it to be non-agentic, meaning deterministic code rather than an LLM. Two mandate types do the work:

• A checkout mandate proves to the merchant that the agent may buy the specific checkout it assembled. It is bound by hash to a checkout that the merchant itself signed, and the merchant returns a signed receipt.
• A payment mandate proves to the credential provider, card network and payment processor that the agent may pay for that checkout, and also produces a receipt.

Version 0.1 used three mandate types (intent, cart and payment); 0.2 reorganized them into checkout and payment mandates with explicit schema versioning. It also added 'Human Not Present' flows, where an agent completes a purchase autonomously within limits the user signed in advance, such as buying limited-release tickets the moment they go on sale. Google describes the user side simply: tell the agent which brands and products you want and how much it may spend, and it only buys when those criteria are met, leaving a permanent record.

AP2 is deliberately narrow. It does not define catalogs, carts or checkout APIs; it runs as a security layer inside a commerce protocol and is designed to work with Google's Universal Commerce Protocol. It is payment-method agnostic, covering cards as well as other rails, and Google has connected x402 stablecoin payments to it. Mastercard co-developed Verifiable Intent, a related standard for tamper-proof logs of user-authorized agent actions, which is also being donated to FIDO. Our comparison of AP2, ACP and MCP covers how it relates to the Agentic Commerce Protocol, which handles checkout and feeds for ChatGPT and Copilot.

For brands, AP2 matters most once purchases become autonomous. When an agent buys within a signed budget and brand list, the user is not looking at a product page at the moment of purchase. The agent decides from structured data whether your offer meets the mandate's criteria, and your payment stack decides whether it can verify the mandate and accept the order. Visibility work, accurate product feeds and payment-partner support together decide whether you capture those orders. The wider context is covered under agentic commerce and AI agents.