Agentic commerce protocols list: ACP, UCP, AP2, TAP, x402 tracker

Six protocols make up the working list of agentic commerce protocols in October 2026: OpenAI and Stripe’s ACP, Google and Shopify’s UCP, AP2 (created by Google, now owned by the FIDO Alliance), Visa’s Trusted Agent Protocol (part of Visa Intelligent Commerce), Mastercard Agent Pay and x402 (created by Coinbase, now at the Linux Foundation). ACP, UCP and x402 carry real payments, and Visa reports live agent purchases with participating merchants in Europe. Mastercard Agent Pay is still rolling out, and AP2 is a published specification.

How we checked this

We read each protocol owner’s own specification, repository or announcement (OpenAI, Stripe, Google, Shopify, the FIDO Alliance, Visa, Mastercard, Coinbase and the Linux Foundation) and cross-checked status and adoption claims against trade coverage (Checkout.com, Shopifreaks, Eco, Sherlock, AMINA Bank). This is a review of published documentation, not a test of the protocols. We refresh the tracker at the start of each month. Facts checked on October 2, 2026.

This page sits in our Agentic payments guides. If you are new to the topic, start with Agentic payments, explained: how AI agents pay and who is behind it.

What changed this month

Changes between our September and October checks, from the owners’ own pages:

• OpenAI stepped back from in-chat checkout. OpenAI’s page for merchants now says: “We’re moving away from a standalone Instant Checkout experience in ChatGPT and prioritizing better shopping discovery and merchant-owned checkout experiences,” and that purchases “are completed on merchant-owned websites or apps.” It still calls ACP “the open infrastructure for AI-native commerce in ChatGPT” (OpenAI). The change dates to an OpenAI post of March 24, 2026 (OpenAI). What it means for buyers is in our guide to ChatGPT Instant Checkout.
• UCP’s latest release is now listed. Version 2026-08-25 adds 3D Secure (3DS2) flows, split payments, deferred payments, deposits and installments, a loyalty extension, and groundwork for grocery, food and lodging (UCP on GitHub).
• Google checkout is on by default for Shopify stores. Shopify says direct checkout in Google AI Mode and Gemini “is activated by default for eligible stores,” meaning U.S. stores selling to U.S. customers, paid by credit or debit card (Shopify Help Center). Our news item covers the switch-off setting.
• Shopify opened checkout to browser agents. Since September 28, browser agents can read and update Shopify checkouts through WebMCP tools (Shopify changelog; Radlof).
• Visa reports live agent purchases in Europe. In a July 2, 2026 release, Visa said “AI agents are now completing purchases with participating merchants,” with more than 30 European issuers, the Trusted Agent Protocol and Agent Directory, and Visa Payment Passkeys for authentication (Visa). We have moved Visa’s status from pilot to live for Europe.
• Mastercard added two layers to Agent Pay. On September 9 it launched Agent Connect, a single integration point for merchants, agents and payment providers, naming Castlery, Fiserv, Global Payments, Moneris, Nexi, Trip.com and Worldline (Mastercard). On September 30 it announced an AI transaction probability score and other risk signals for banks and merchants, starting with U.S. testing (Mastercard; Radlof).
• Visa, Mastercard and Ant International started work on agent identity. On September 9 the three announced a collaboration on interoperability between their Know Your Agent frameworks (Business Wire; Radlof).
• x402 grew past 50 members. Block said on September 24 that it had joined the x402 Foundation (Block). On October 1 the Linux Foundation named Michael Hursta executive director and said the Foundation has “more than 50 active members” (Linux Foundation).
• No new versions of ACP or AP2. ACP’s latest dated release is still 2026-04-17, which added cart, feed, orders, authentication and MCP support, and the repository still labels the spec beta (ACP repo). AP2 remains at version 0.2 (AP2 releases).

The tracker table

Status key: spec = published specification, no confirmed consumer purchases; pilot = limited, closed-beta or partner-only deployment; live = real purchases by the public confirmed in a source we opened.

ACP: OpenAI and Stripe’s checkout protocol

The ACP repository describes the Agentic Commerce Protocol as an open standard “maintained by OpenAI and Stripe” and “currently in beta,” with dated spec releases. Stripe’s documentation calls it an open standard created by Stripe, OpenAI and Meta, built from composable pieces: agentic checkout, cart and product feeds, delegated payment, delegated authentication through OAuth 2.0, and order webhooks.

OpenAI launched ACP alongside Instant Checkout in ChatGPT, starting with US Etsy sellers and with Shopify merchants such as Glossier and SKIMS announced as “coming soon.” In that flow, ChatGPT passes the order to the merchant’s backend, and the merchant accepts or declines it, charges through its existing processor and handles fulfillment and support. Merchants not on Stripe can use Stripe’s Shared Payment Token API or ACP’s Delegated Payments spec. Checkout.com says it has adopted ACP.

OpenAI’s developer docs spell out how checkout inside ChatGPT works. “Building with the Agentic Commerce Protocol is open to all,” but Instant Checkout in ChatGPT “is currently available to approved partners.” ChatGPT collects the buyer’s shipping and payment details and calls the merchant’s ACP endpoints. The merchant calculates tax, runs its own risk checks, charges the card with its existing processor and accepts or declines the order. For payment, OpenAI creates a one-time delegated payment with a maximum chargeable amount and an expiry, and eligible cards are upgraded to network tokens. OpenAI states that it “is not the merchant of record.”

The consumer surface has changed since launch. On March 24, 2026, OpenAI wrote that “the initial version of Instant Checkout did not offer the level of flexibility that we aspire to provide, so we’re allowing merchants to use their own checkout experiences while we focus our efforts on product discovery” (OpenAI). Its merchant page now says purchases “are completed on merchant-owned websites or apps” and that ACP remains “the open infrastructure for AI-native commerce in ChatGPT” (OpenAI). Merchants that want checkout inside ChatGPT build apps: Instacart takes payment in the chat, and Walmart’s app links Walmart accounts and payments. OpenAI’s Help Center still says ChatGPT may show an Instant Checkout option for some eligible products. Buyers can read what this means in ChatGPT Instant Checkout: how buying in ChatGPT works now, and the refund side in An AI agent bought the wrong thing. Who pays?.

UCP: Google and Shopify’s full-journey protocol

The Universal Commerce Protocol covers discovery, checkout and post-purchase. Google’s developer post shows merchants publishing a capability profile (checkout, discounts, fulfillment) versioned “2026-01-11,” with payment handlers for Shop Pay and Google Pay (Visa and Mastercard cards). Shopifreaks reported that UCP was co-developed with Etsy, Wayfair, Target and Walmart and endorsed by more than 20 companies, including Adyen, American Express, Best Buy, Mastercard, Stripe, The Home Depot and Visa. Google planned to use it for checkout in AI Mode and Gemini from US retailers, with PayPal “coming soon.”

On status, Eco’s UCP explainer says UCP is released under Apache License 2.0 and wired into AI Mode, the Gemini apps and Microsoft Copilot Checkout for 20-plus retailers. That is a secondary source. The UCP repository shows dated releases after the January launch, the latest on August 25, 2026, which adds 3DS2 authentication, split and deferred payments, installments and a loyalty extension. On Shopify, direct checkout in Google AI Mode and Gemini is “activated by default for eligible stores,” and merchants can turn it off under Sales channels (Shopify Help Center). We compare the two checkout standards in ACP vs UCP.

AP2: the payment-authorization layer, now at FIDO

Google announced AP2 on September 16, 2025, as an open protocol for agent-led payments that can run as an extension of the Agent2Agent (A2A) protocol and the Model Context Protocol (MCP). Google calls it “payment-agnostic,” meaning it is meant to work across cards, bank transfers and other methods. Launch statements came from Worldpay, ServiceNow and Shopee, among others. In the same post Google described the A2A x402 extension, built with Coinbase, the Ethereum Foundation, MetaMask and others, as “a production-ready solution for agent-based crypto payments.” Coinbase’s own post on x402 inside AP2 is dated September 16, 2025.

On April 28, 2026, Google donated AP2 to the FIDO Alliance, so it is no longer a Google-owned spec. The same day Google released AP2 version 0.2 on GitHub. It adds “Human Not Present” payments, where an agent pays on its own under instructions the user approved in advance, such as buying limited-run tickets the moment they go on sale. Google also named Verifiable Intent, an AP2-compatible standard co-developed with Mastercard and also donated to FIDO, which keeps a tamper-proof log of what the user authorized.

The AP2 repository holds the specification, a Python SDK and reference scenarios in Python, Go and Android. Eco describes AP2 as a signed user “mandate” proving intent and lists it as live alongside UCP. Google and FIDO present AP2 as a specification with an SDK and samples, so the status cell reads “spec.” The FIDO Alliance’s Payments Technical Working Group builds on the Google (AP2) and Mastercard (Verifiable Intent) contributions (FIDO Alliance).

Visa Trusted Agent Protocol and Visa Intelligent Commerce

Visa unveiled the Trusted Agent Protocol on October 14, 2025. It was developed with Cloudflare and published in the Visa Developer Center and on GitHub. Visa names Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe and Worldpay as early partners that gave feedback. The protocol builds on the HTTP Message Signature standard, so merchants can recognize a trusted AI agent without writing code. The agent carries three kinds of signals: agent intent (it wants to view or buy a specific product), consumer recognition (whether the shopper already has an account with the merchant) and, optionally, payment information. Visa’s newsroom release describes the same design, and Visa says it is working with Coinbase on interoperability with x402. Checkout.com adds that Visa also updated network token provisioning for context-specific agent use.

TAP sits inside Visa Intelligent Commerce, which Visa describes as its portfolio for AI-initiated transactions: credentials, spending controls, authentication and protections. Visa’s own footnote says the product “is currently in the process of deployment.” In a December 18, 2025 release, Visa said “hundreds” of controlled, real-world agent-initiated transactions had been completed. It said more than 100 partners were working with it, over 30 were building in its sandbox, and US pilots from Skyfire, Nekuda, PayOS and Ramp were running consumer and business purchases “in closed beta.” Visa expected pilots in Asia Pacific and Europe in early 2026 and added Akamai as a TAP supporter. In Europe, Visa went further. Its July 2, 2026 release says “AI agents are now completing purchases with participating merchants,” with more than 30 European issuers and merchants including lastminute.com and Frasers, using TAP, Visa’s Agent Directory and Visa Payment Passkeys to authenticate each payment. That is why the status cell now reads live for Europe and pilot for the US. Visa also points to a partnership with OpenAI. More for cardholders in Visa Trusted Agent and Mastercard Agent Pay: what changes for cardholders.

Mastercard Agent Pay

Mastercard announced Agent Pay on April 29, 2025 as its “Agentic Payments Program.” It builds on tokenized card credentials, so the agent carries a token rather than the card number. At launch Mastercard named Microsoft as an AI platform partner, IBM’s watsonx Orchestrate for business-to-business use cases, and Braintree and Checkout.com as acquirers. Checkout.com groups Agent Pay with Visa Intelligent Commerce as the networks’ tokenization layer for agent payments.

On rollout, Mastercard’s September 10, 2025 release named Stripe, Google and Ant International’s Antom as partners. It said Citi and U.S. Bank Mastercard cardholders would go first, as agentic commerce providers such as PayOS, Firmly.AI and Basis Theory went live. It also said all U.S. Mastercard cardholders would be enabled “by the holiday season,” with a global rollout “shortly thereafter.” A Mastercard story dated September 30, 2025 said Citi and U.S. Bank cardholders were “already enabled,” with all U.S. cardholders due by mid-November. The same story said Agent Pay and Agentic Tokens could be used in ChatGPT’s Instant Checkout. Mastercard’s pages describe those rollout dates as plans, so the cell reads “pilot, rolling out” rather than “live.”

In September 2026 Mastercard added two pieces around Agent Pay. Agent Connect, launched September 9, gives merchants, agents and payment providers one integration point, with Castlery, Fiserv, Global Payments, Moneris, Nexi, Trip.com and Worldline named. On September 30 Mastercard announced trust and intelligence services, including a score of how likely it is that an AI agent started a transaction, launching for U.S. testing. On September 9, Mastercard, Visa and Ant International also announced work on interoperable Know Your Agent frameworks.

x402: stablecoin payments over HTTP

Coinbase launched x402 on May 6, 2025 as a protocol for instant stablecoin payments made directly over HTTP. A server answers a request with the long-unused HTTP 402 “Payment Required” status and payment instructions; the agent pays and the server checks the payment on-chain before granting access. Coinbase also positions it as the stablecoin extension to Google’s AP2.

Coinbase no longer runs it alone. On April 2, 2026, the Linux Foundation announced the x402 Foundation and Coinbase’s contribution of the protocol, which matches AMINA Bank’s account. The release says the Foundation was initially developed by Coinbase, Cloudflare and Stripe. On July 14, 2026, the Linux Foundation said the Foundation was fully operational and the contribution complete, with 40 members. Block joined on September 24, and on October 1 the Linux Foundation named Michael Hursta executive director and put membership at “more than 50 active members”. Premier members include Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Shopify, Stripe and Visa. The Foundation describes x402 as supporting payment types “from traditional cards to stablecoins,” while the published usage figures below are for stablecoin payments.

On volume, Sherlock reports 75 million transactions worth $24 million by December 2025 and more than 119 million transactions on Base alone by March 2026. Those are third-party figures, not audited totals. x402 mostly moves small amounts between software, such as paid API calls, rather than retail checkouts. This is a payment rail, not an investment; we explain it in x402 in plain language.

What to watch out for

• “Supports” can mean a press quote. Endorsing a protocol at launch is not the same as processing live orders. We only mark “live” when a source shows purchases happening.
• A rollout date is not a rollout. Mastercard announced dates for enabling all U.S. cardholders. Visa predicted that millions of consumers would use AI agents to complete purchases by the 2026 holiday season. Both are plans stated by the companies, not measured results.
• Specs are still in beta. ACP says so in its repo, and AP2 is at version 0.2. Field names and flows change between dated versions, so a merchant integration can break.
• Secondary trackers disagree. Eco, for example, says ChatGPT Instant Checkout was “retired.” OpenAI’s own merchant page says it is “moving away from a standalone Instant Checkout experience,” while its Help Center still describes an Instant Checkout option for some eligible products. Read the owner’s own page before you act on a status.
• Buyer protections depend on the rail. A card purchase through ACP or UCP keeps your card issuer’s dispute process. A stablecoin payment through x402 settles on-chain and generally has no chargeback. If a disputed amount is large, talk to your card issuer or a consumer-protection attorney.

Go deeper

• Agentic payments, explained: how AI agents pay and who is behind it
• ACP vs UCP: OpenAI’s and Google’s checkout protocols compared
• x402 in plain language: how agents pay per request in USDC
• Visa Trusted Agent and Mastercard Agent Pay: what changes for cardholders
• Accepting payments from AI agents as a small business, without code
• ChatGPT Instant Checkout: how buying in ChatGPT works now

Changelog

• October 2, 2026: monthly refresh. Added “What changed this month.” ACP row updated for OpenAI’s move to merchant-owned checkout. UCP row adds the 2026-08-25 release and default-on Google checkout for Shopify stores. Visa row moved to live in Europe. Mastercard row adds Agent Connect and the September 30 risk services. x402 membership updated to more than 50.
• September 24, 2026: status, adopters and sources checked for all six protocols.