An AI agent that can read a product page is a demo. An agent that can add to a cart and pay is a new sales channel, and also a new way to lose money. Three open protocols are being pushed to make that safe and standard: ACP, UCP and AP2. If you run a store or build payments code, here is what each one does, how they differ, and what to do this month.
Everything below was read on the projects' own pages on 2026-10-16. Where a page did not say, I say so. Press coverage of these protocols disagrees on dates and status, so I used that only as a pointer.
What is agentic commerce, in one paragraph
Agentic commerce means a software agent acts for a buyer: it finds products, builds a cart, and completes payment, often inside a chat. The hard parts are not the chat. They are three questions. How does the agent read a seller's catalog and prices? How does it hand over payment credentials without exposing a card number? How does anyone prove the user actually agreed to this purchase? ACP, UCP and AP2 each take a different slice of those questions.
What is ACP (Agentic Commerce Protocol)?
ACP is the checkout-and-payment protocol behind OpenAI's commerce work. The ACP site describes it as "an open specification that enables a programmatic exchange between buyers, their AI agents, and sellers". On its GitHub README, the spec is "maintained by OpenAI and Stripe and is currently in beta", under Apache 2.0, with date-based versions. The latest stable version listed was 2026-04-17.
The spec is split into a checkout API and a delegated payment API, each published as OpenAPI. The checkout reference lists five operations:
| Operation | Endpoint |
|---|---|
| Create a session | POST /checkout_sessions |
| Retrieve | GET /checkout_sessions/{id} |
| Update | POST /checkout_sessions/{id} |
| Complete | POST /checkout_sessions/{id}/complete |
| Cancel | POST /checkout_sessions/{id}/cancel |
Requests carry Authorization, Content-Type and an API-Version header in YYYY-MM-DD form. Idempotency-Key is optional, which matters more than it sounds (see below). A session moves through these documented statuses: incomplete, not_ready_for_payment, requires_escalation, authentication_required, ready_for_payment, pending_approval, complete_in_progress, completed, canceled, in_progress and expired.
The key design choice: the agent renders the checkout UI and collects the buyer's choices and payment credentials, while sellers "keep their existing back-end models and payment processing".
OpenAI's developer pages describe the pieces as "agentic checkout, delegated payment, and product feeds", and say to start by sharing a structured product feed. Those pages separate product data "for discovery in ChatGPT" from the requirements for ads and checkout. Some press reports say OpenAI changed its first Instant Checkout product in 2026. I could not confirm that on OpenAI's own pages, so I am not repeating it as fact.
What is UCP (Universal Commerce Protocol)?
UCP is the wider net. Its site calls it "the common language for platforms, agents, and businesses" and says it is "co-developed by industry leaders", naming Google, Shopify, Amazon, Microsoft, Meta and Stripe among others. It is Apache 2.0, with copyright credited to "UCP Authors".
Scope is the difference. The site lists shopping capabilities as catalog, cart, checkout, identity linking and order management. Lodging booking is a draft spec and food ordering is marked as in development. It uses REST and JSON-RPC transports and has built-in support for AP2, A2A and MCP.
I could not retrieve the UCP spec pages themselves in this session, so I am not describing its endpoints or discovery files. Read the spec before you build against it.
What is AP2 (Agent Payments Protocol)?
AP2 answers "did the user really approve this?" Its site calls it "an open protocol for the emerging Agent Economy". It extends A2A, integrates with UCP, and is copyrighted by Google with a public repository. Standardisation is continuing in FIDO working groups, per the site.
It uses two kinds of verifiable credential, each with an open and a closed stage:
| Mandate | Open stage | Closed stage |
|---|---|---|
| Checkout Mandate (shared with the merchant) | The user's constraints and goals before the cart is final | Authorisation for a finalised checkout |
| Payment Mandate (shared with the credential provider, networks and processor) | Payment constraints such as budget and allowed instruments | A specific amount bound to a finalised checkout |
The initial version supports pull payments such as credit and debit cards. The roadmap names e-wallets, push payments and digital currencies. If you know UPI, note that nothing I read says AP2 supports it today.
How do ACP, UCP and AP2 fit together?
They are layers more than rivals. A rough map from the pages above:
| Question | Where the answer lives |
|---|---|
| How does an agent see my catalog and cart? | UCP (catalog, cart) or an ACP product feed |
| How does the agent check out with me? | ACP checkout API, or UCP checkout |
| How is the payment credential passed? | ACP delegated payment, or a provider token such as Stripe's |
| How do we prove the user approved it? | AP2 mandates |
| How do agents talk to each other and to tools? | A2A and MCP, which UCP builds in |
Stripe's agentic commerce docs make the overlap concrete. For sellers, the "sell through agents" row lists the protocol as "UCP or ACP". Stripe also lists a separate path for machine payments, where agents pay for APIs, using MPP or x402. Its agent-side offering for embedding commerce was labelled private preview when I read it.
What should a merchant do now?
Do the dull things first. They pay off whichever protocol wins.
- Fix your product data. Both OpenAI's docs and the protocols assume structured feeds. Titles, prices, stock, variants, shipping and return policy as fields, not prose. This also helps classic search and AI citations.
- Ask your platform what it supports. If you are on Shopify or use Stripe, check their current docs for UCP and ACP support before commissioning custom work.
- Make checkout safe to retry. Agents will retry. Idempotency and webhook handling are not optional, so read Razorpay webhooks and idempotency even if you use a different gateway.
- Write down your return and cancellation rules. An agent buying on someone's behalf will quote them back to the buyer.
- Decide your limits. Maximum order value for agent checkout, which categories are excluded, and when a human must confirm.
Why does idempotency matter for agent checkout?
Because an agent that times out will call again. If POST /checkout_sessions creates a new session each time, you can end up with two live carts, two holds on stock, or two charges downstream.
Below is a small sketch I ran on 2026-10-16. The endpoints, header names and status values come from the ACP checkout reference. The replay rule, stock check and 422 for a reused key are my own design, not something the spec requires.
def create_session(self, headers, body):
missing = [h for h in ("Authorization", "Content-Type", "API-Version") if h not in headers]
if missing:
return 400, {"error": f"missing headers: {missing}"}
key = headers.get("Idempotency-Key")
raw = json.dumps(body, sort_keys=True)
if key in self.replays:
old_raw, old_resp = self.replays[key]
if old_raw != raw:
return 422, {"error": "idempotency key reused with different body"}
return 201, old_resp # same request, same answer, no second session
...
Output from the full script:
first call -> 201 1 session(s)
retry same key -> 201 1 session(s)
same key, new body -> (422, {'error': 'idempotency key reused with different body'})
missing API-Version -> (400, {'error': "missing headers: ['API-Version']"})
out of stock -> (201, {'id': None, 'status': 'not_ready_for_payment', 'reason': 'out_of_stock'})
The retry returns the same answer without a second session. That is the behaviour to test for on your own checkout. This is an in-memory toy: it has no payment step, no persistence and no authentication.
What about Indian stores and payments?
The specs are open. What is not clear from the primary pages I read is which countries get which agent surfaces and payment products. Stripe's docs I read did not state India availability either way, so check their current pages. For the payments side in India, the existing guides are the better start: agentic payments with Razorpay and UPI and Shopify payments in India.
If you are building agents, not selling through them, read A2A and MCP first. UCP says it builds on both.
What is still unverified
- Current status of OpenAI's Instant Checkout, which press reports describe inconsistently.
- UCP endpoint details and discovery mechanism (spec pages not retrieved).
- Whether any of this is live for merchants in India.
- Real adoption numbers. I found none from primary sources, so I am giving none.
Re-check the linked specs before shipping. All three are young and the version labels on their own pages say so.
