What is the Agentic Commerce Protocol (ACP)? How AI agents check out
ACP gives an agent a checkout session it can call and a payment token capped to one purchase. The seller stays merchant of record and keeps its own processor.
In this essay
The Agentic Commerce Protocol (ACP) is an open specification for how an AI agent completes a purchase with a business on a buyer's behalf. It defines a checkout session the agent creates, updates and completes through a REST API, plus a delegated payment step that hands the seller a payment token capped to that one purchase. Newer versions add product feeds, order webhooks and delegated authentication. The seller remains the merchant of record and keeps its existing payment processor.
Who created ACP?
The primary sources word the origin differently, so it is worth quoting them as written:
- Stripe's documentation calls ACP an "open standard created by Stripe, OpenAI, and Meta that defines how AI agents interact with businesses to complete purchases on behalf of buyers." Stripe: Agentic Commerce Protocol
- The protocol's GitHub repository says the specification "is currently maintained by OpenAI and Stripe." GitHub: agentic-commerce-protocol
- OpenAI introduced ACP in the same announcement as Instant Checkout in ChatGPT. OpenAI: Buy it in ChatGPT
The full specification lives at agenticcommerce.dev. In a contract or requirement, cite a dated version, not a vendor summary.
What does ACP specify?
ACP's architecture page describes two core specifications: Agentic Checkout, which covers the checkout session between agent and seller, and Delegate Payment, which covers tokenizing a payment credential between agent and payment service provider (PSP) within spending constraints. ACP: architecture Stripe's summary lists the wider set of building blocks: agentic checkout, cart and product feeds, payment-token delegation, OAuth 2.0-based delegated authentication and order webhooks. Stripe: Agentic Commerce Protocol
| Building block | What it does | Who implements it |
|---|---|---|
| Agentic Checkout | Create, retrieve, update, complete and cancel a checkout session | Seller |
| Delegate Payment | Turns a buyer's credential into a token limited by an allowance | PSP, or a merchant with its own compliant vault |
| Product feed | Structured catalog that agents search and rank | Seller, often through a platform |
| Order webhooks | Signed order events after checkout | Seller |
| Capability negotiation | Agent declares what it supports; seller returns the overlap | Both sides |
The changelog lists dated releases, including 2026-01-16 for capability negotiation, 2026-01-30 for extensions, discounts and payment handlers, and 2026-04-17 for cart, feed, orders, authentication and MCP. The 2026-01-30 release changed how payment methods are declared, a breaking change. ACP: changelog Record the version you implement with each partner.
How does an ACP checkout work, step by step?
The seller exposes five endpoints: POST /checkout_sessions to create, GET /checkout_sessions/{id} to retrieve, POST /checkout_sessions/{id} to update, POST /checkout_sessions/{id}/complete to complete and POST /checkout_sessions/{id}/cancel to cancel. ACP: getting started for sellers
In OpenAI's version of the checkout spec, a new session is not_ready_for_payment while required information is missing and ready_for_payment once it is complete. Updates return recalculated totals and options, such as delivery choices after an address change. Completion processes the payment and returns the order; a failed payment can return the session to ready_for_payment. OpenAI: Agentic Checkout Spec The current ACP reference lists additional states, such as requires_escalation and expired, so validate against the version you pinned. ACP: checkout reference
It sends items and buyer context to the seller's checkout endpoint.
Address and delivery choices change the totals the buyer approves.
The allowance caps the amount, expiry and the checkout it can pay.
The agent can offer another payment method or stop.
The seller returns the order in the response.
Shipping, cancellation and refund updates reach the agent and buyer.
Simplified: capability negotiation, authentication and error handling are omitted.
How does delegated payment work in ACP?
Delegated payment lets the agent pay without passing the buyer's raw card details. OpenAI's Delegated Payment Spec defines an allowance with a reason (only one_time), a max_amount and an expires_at time. OpenAI: Delegated Payment Spec The ACP reference adds currency, checkout_session_id and merchant_id, states max_amount in minor units, and returns a vault token that can be used only within those limits. ACP: delegate payment
OpenAI's spec says direct integration is only for PSPs or PCI DSS Level 1 merchants using their own vaults; others use a compatible PSP implementation, with Stripe's Shared Payment Token named as the first. OpenAI also notes that using your PSP's implementation may avoid a change in PCI scope, while forwarding APIs or direct integration involve cardholder data and will likely be in scope. OpenAI: Delegated Payment Spec Stripe documents the token side in Stripe: shared payment tokens.
The seller still charges through its own processor. ACP's seller guide says sellers remain the merchant of record ACP: getting started for sellers, and OpenAI's production guide says the merchant is responsible for refunds and chargebacks. OpenAI: in production If you sell through platforms, merchant of record vs payment processor explains why that distinction drives liability.
What happened to Instant Checkout in ChatGPT?
OpenAI's launch post described buyers tapping Buy, confirming order, shipping and payment details, and completing the purchase in the chat, with orders, payments and fulfillment handled by the merchant's existing systems. OpenAI: Buy it in ChatGPT
OpenAI later changed course. Its product discovery post says the initial version of Instant Checkout did not offer the flexibility it aimed for, so merchants can use their own checkout experiences while OpenAI focuses on product discovery, and merchants wanting deeper experiences can build ChatGPT apps. OpenAI: Powering product discovery in ChatGPT OpenAI's developer guide separates the two: building with ACP is open to all, while Instant Checkout is available to approved partners. OpenAI: key concepts
Treat ACP as a protocol and Instant Checkout as one product built on it; do not size a business case around a single agent surface.
What does a merchant need to integrate?
| Workstream | What to build or decide | Evidence before launch |
|---|---|---|
| Product feed | Required fields; OpenAI's feed spec lists item_id, title, description, url, brand, seller_name, image_url, availability and price |
Rejected-row report is empty |
| Checkout API | The five endpoints, with capabilities declared in every response from version 2026-01-30 | Test sessions for each state |
| Payment | Your PSP's delegated payment support | PSP confirmation and PCI scope review |
| Order webhooks | Signed events carrying the full order object | Signature check and replay test |
| After-sales | Refunds and chargebacks stay with you and your PSP | Refund update reaches the agent |
| Retries | One order per checkout, even on timeouts | Duplicate-complete test passes |
Sources: OpenAI: product feed spec, ACP: webhooks, OpenAI: in production. OpenAI's checkout spec also describes conformance checks covering schema, error codes, rate limits and webhook delivery.
Webhook event names differ between documents (order_create in the ACP reference, order_created in OpenAI's pages), another reason to pin a version. Handle them as described in payment webhooks that arrive twice or out of order, and make the complete call safe to retry with payment idempotency.
Stripe describes its Agentic Commerce Suite as a single integration for selling across agents that handles Shared Payment Tokens, with catalog, checkout, payments and order notifications usable as separate stages. Stripe: how Agentic Commerce Suite works
ACP vs UCP vs AP2: what is the difference?
ACP is a checkout and delegated payment contract between an agent and a seller. The Universal Commerce Protocol (UCP) is a separate open standard for interoperability across commerce transactions; Stripe lists itself as a member of its Tech Council. Stripe: Universal Commerce Protocol The Agent Payments Protocol (AP2) focuses on signed mandates that prove what a buyer authorized and leaves catalog and checkout APIs outside its scope. AP2 specification See what AP2 is.
Each has its own versions and failure modes; MCP, A2A, ACP, AP2 and UCP compared goes deeper.
FAQ
Is the Agentic Commerce Protocol an open standard?
Yes. Stripe calls it an open standard, and the specification is public at agenticcommerce.dev and on GitHub, maintained by OpenAI and Stripe.
Does ACP replace my payment processor?
No. The seller remains the merchant of record and charges the delegated token through its own PSP, which keeps settlement, refunds and chargebacks.
What is the difference between ACP and Instant Checkout?
ACP is the protocol. Instant Checkout is OpenAI's in-chat checkout built on it, available to approved partners; OpenAI also lets merchants use their own checkout while it focuses on product discovery.
Do I need PCI DSS Level 1 to support ACP?
Only if you integrate the delegated payment endpoints directly with your own vault. Merchants without one use their PSP's implementation, which OpenAI says may avoid a change in PCI scope.
Which ACP version should I build against?
The dated version your agent partners and PSP support. Releases can break compatibility, as the 2026-01-30 payment changes did.
Closing thought and further reading
ACP gives an agent a checkout session it can call and a payment token capped to one purchase. The seller stays merchant of record and keeps its own processor.
Ideas that continue the thread.
View all essays
Need help applying this to your business?
Explore practical support for payment operations, product decisions, program delivery and AI automation, grounded in the challenges behind this essay.