ACP (Agentic Commerce Protocol): checkout without exposing the card

What it is

ACP (Agentic Commerce Protocol) is an open agentic-checkout protocol from OpenAI and Stripe (backed by Meta). It lets an agent complete a purchase — cart, shipping, payment — via Shared Payment Tokens, without exposing the user’s payment details. Released 29 September 2025 (beta); live transactions on Etsy, Shopify, Walmart. It uses the native MCP transport.

Why it matters for AI agents

Without a standard, an agent can’t complete checkout autonomously — it would need the user’s card or manual approval. ACP solves this with Shared Payment Tokens:

1. The user authorises the agent once via OAuth 2.0 delegation.
2. The agent gets a token — not card data, but permission to transact.
3. Stripe processes the payment without exposing card details to the agent.

Capability	Description
Agentic checkout	Cart, shipping, payment in one flow
Shared Payment Tokens	Pay without exposing card data
OAuth 2.0 delegation	The user explicitly delegates rights
MCP transport	Embeds into existing MCP servers

How to declare support

In ai-agent.json:

{ "payments": { "acp": "https://api.example.com/acp" } }

Or via a Link header:

Link: <https://api.example.com/acp>; rel="acp-endpoint"

Common mistakes

• No declaration — the agent never learns of ACP support.
• Checkout without OAuth 2.0 delegation — you lose the Shared Payment Token model.
• Declared, but the MCP transport isn’t set up — the flow can’t be assembled.

How to verify

The ACP check is informational (doesn’t affect the score). The scanner looks for a declaration: a payments.acp field in /.well-known/ai-agent.json, or a Link header with rel="acp-endpoint". The real checkout, OAuth delegation, and Stripe settlement aren’t tested.

curl -s https://example.com/.well-known/ai-agent.json | jq '.payments.acp'
curl -sI https://example.com/ | grep -i 'acp-endpoint'