Agentic Payments in 2026: AP2, ACP and x402 Explained

For two years the demo was always the same: an AI agent fills a shopping cart, then stops at the checkout and hands the browser back to you to type in a card number. That last step was the wall. An agent could research, compare, and decide, but it could not pay, because nobody had answered the question a merchant actually cares about. When software clicks "buy," who authorised it, for how much, and who is liable if it gets the amount wrong?

In 2026 that wall is coming down, and it is coming down through standards rather than any single company's checkout button. Four protocols now compete to let an agent pay: Google's AP2, the ACP work from OpenAI and Stripe, Coinbase's x402, and Stripe's own MPP. If you sell anything online, or build the software that does, this is the plumbing that decides whether AI shoppers can buy from you at all. It is worth understanding before your competitors' agents start routing spend around you.

The problem these protocols solve

A normal card payment assumes a human is present, tapping a phone or typing a CVV. Agentic commerce breaks that assumption. The buyer is software acting on someone's behalf, possibly hours after the person went to bed. That creates three gaps the old rails were never built for.

• Authorisation. Did the human actually approve this purchase, or just say "book me a flight under 400 euros" last week? A merchant needs proof the agent is inside its mandate.
• Liability. If the agent buys the wrong thing or overpays, who eats the cost: the user, the merchant, the agent's developer, or the payment network?
• Amount integrity. The price the user agreed to and the price finally charged have to match, even though a human is not there to eyeball the total.

Every protocol below is really an answer to those three questions. They differ mostly in how they prove intent and what kind of money moves at the end.

AP2: the authorisation layer

Google announced the Agent Payments Protocol (AP2) in September 2025 with more than 60 launch partners, including Mastercard, PayPal, American Express, Coinbase and Salesforce. In May 2026 it was contributed to the FIDO Alliance alongside Mastercard's Verifiable Intent work, which is a strong signal that it is heading toward being a shared industry standard rather than one vendor's toy.

AP2 is best understood not as a new way to move money but as a way to prove intent. It works through signed mandates. A Checkout Mandate records what the user wants to buy and under what conditions; a Payment Mandate records the amount, the instrument and the timing. Each mandate is cryptographically signed and moves through states as the cart goes from in-progress to finalised, so a merchant can verify, after the fact, exactly what the human agreed to.

Crucially, AP2 is payment-method agnostic. It sits above cards, bank transfers and stablecoins, describing the authorisation rather than replacing the rails. If you already take cards, AP2 is more of an addition than a rip-and-replace.

ACP and MPP: the checkout and the machine rails

The Agentic Commerce Protocol (ACP), from OpenAI and Stripe, comes at it from the storefront side. It standardises the checkout itself so that an agent, for instance one shopping inside ChatGPT, can complete a purchase against a compatible merchant without screen-scraping a web form. If AP2 is about proving the buyer had permission, ACP is about giving the agent a clean, structured checkout to push that purchase through.

MPP, Stripe's Machine Payments Protocol, targets the more autonomous end: machine-to-machine payments where software pays software, think an agent topping up an API it depends on, with far less human ceremony per transaction.

The important thing is that these are not strictly rivals to AP2. A real transaction might use ACP for the checkout handshake and AP2 mandates for the authorisation proof. The stack is layering, not consolidating into one winner.

x402: paying in stablecoins over HTTP

x402, championed by Coinbase, is the odd one out and the most futuristic. It revives the long-dormant HTTP 402 Payment Required status code and uses it to settle payments in stablecoins directly over the web protocol. An agent requests a resource, gets a 402 with a price, pays in stablecoin, and receives the resource, all in one machine-native flow with no card network in the middle.

For most storefronts selling to consumers, x402 is not the near-term concern. Where it gets interesting is pay-per-use digital services and agent-to-agent commerce: metered API calls, data feeds, compute, the kind of tiny frequent payments that card fees make uneconomic. If your product could be sold by the request rather than the subscription, x402 is the one to keep an eye on.

What this means for your business

You do not need to implement anything this quarter. You do need a position, because agentic traffic is already arriving and the merchants who are legible to agents will win the spend the same way mobile-friendly sites won a decade ago.

If you run an online store, the practical move is making your catalogue and checkout machine-readable, which is the same groundwork behind getting your store ready for AI shoppers and making your site agent-ready. Clean product data, structured pricing, and a checkout that does not depend on a human wrestling a form is 80% of it. Which payment protocol you formally support can wait until your payment provider ships support, which most are racing to do.

If you build software, watch what Stripe, PayPal, Adyen and your acquirer announce, because they will do the heavy lifting. Your job is to design agent-initiated purchases with mandates and spending limits in mind from the start, rather than bolting authorisation on later. Our note on when AI agents start to check out goes deeper on the merchant-side design.

Everyone should treat this as a trust problem, not just a payments one. The whole reason these protocols exist is to make an autonomous purchase auditable and bounded. That mindset, cryptographic proof of intent, hard spending limits, a clear liability trail, is exactly the discipline you want around any agent that can spend money, which we cover in securing AI agents.

The short version

Agentic payments in 2026 are not one standard but a layered stack that is still forming. AP2 proves the human authorised the purchase. ACP standardises the checkout an agent pushes it through. MPP handles machine-to-machine payments, and x402 moves stablecoins over HTTP for pay-per-use and agent-to-agent commerce. The convergence point is coming, but it has not arrived.

The mistake would be waiting for a single winner before doing anything. The groundwork, structured product data, a machine-readable checkout, and firm spending controls on any agent that pays, pays off no matter which acronym wins. If you want help getting your commerce stack ready for agents that buy on their own, talk to us.