What is Agentic Commerce? The Complete 2026 Guide

Agentic commerce is commerce where an AI agent — not a human clicking through a checkout — discovers products or services, makes purchase decisions and completes payment on a person's or company's behalf. The human sets the intent and the constraints; the agent executes the transaction. In 2026 this stopped being a demo category: card networks, payment processors and open protocols now operate real rails for agent-initiated payments — and a whole vocabulary of controls around them, because an agent with a payment method is also a new category of financial risk.

This guide covers what agentic commerce actually is, how an agent-initiated transaction works, the protocol landscape as it stands in July 2026 (AP2, x402, ACP, UCP), what the payment networks have shipped, the real numbers, the failure modes — and how teams keep agent spending under control.

What is agentic commerce?

The cleanest way to define agentic commerce is by what gets delegated.

• E-commerce delegates nothing: a human searches, compares, decides and pays.
• Conversational commerce delegates the interface: you chat with a bot, but a human still drives every decision and the checkout.
• Agentic commerce delegates the decision and the payment: software acting with autonomy completes some or all of the purchase loop under constraints you set in advance.

In practice it spans a spectrum, and the industry's own protocols now formalize the two ends of it:

1. Human-present: the agent researches, negotiates and assembles the purchase; a person approves the final transaction. Google's agentic checkout in Search and Amazon's shopping agents work this way today.
2. Human-not-present: the agent transacts autonomously inside a pre-authorized envelope — a budget, a merchant list, an expiry. This is the mode that Google's AP2 protocol added as a first-class flow in its v0.2 release in April 2026, and the mode that machine-to-machine payments (an agent paying an API per request) live in permanently.

Three concrete examples running in production in 2026: Amazon's Alexa for Shopping can complete purchases on and off Amazon; Google's agentic checkout buys from merchants like Wayfair and Chewy on a user's behalf via Google Pay; and any AI agent hitting an API fronted by AWS CloudFront can now receive an HTTP 402 Payment Required response and pay per request in stablecoins — no human anywhere in that loop.

How an agentic transaction actually works

Strip away the vendor branding and every agentic transaction has the same skeleton:

1. Intent and constraints. A human (or a company policy) tells the agent what to accomplish and what it may spend: scope, budget, merchant rules, expiry.
2. Discovery. The agent finds candidate products, services or API endpoints — through search, structured merchant feeds, or a protocol-level catalog.
3. Decision. The agent selects what to buy, at what price, from whom.
4. Authorization. The hard part: the merchant and the payment network need proof that this specific agent is entitled to make this specific purchase for this specific principal. This is what payment mandates, verifiable credentials and agent-identity protocols exist for.
5. Payment and settlement. Tokenized card credentials, a wallet the agent controls, or a stablecoin transfer — settling on card rails or on-chain.
6. Reconciliation. Someone has to answer, after the fact: which agent spent what, where, under whose authority, and does it match the books?

Steps 4 and 6 are where agentic commerce differs most from regular e-commerce — and where most of the 2026 protocol activity concentrates. A human proves intent by being present; an agent has to carry cryptographic evidence of delegated authority. And a human generates a few receipts a week, while a fleet of agents can generate thousands of micro-transactions a day across multiple providers.

The protocol landscape in July 2026

2025 was the year of competing protocol announcements. The 2026 story so far is consolidation into standards bodies — and a de facto division of labor where the major protocols increasingly occupy different layers of the same stack rather than competing head-on.

AP2 — the authorization layer

Google announced the Agent Payments Protocol (AP2) in September 2025 with more than 60 organizations, including Mastercard, PayPal, American Express, Adyen and Coinbase. Its core idea: payment mandates — cryptographically signed credentials that capture what a user authorized an agent to do, so merchants and issuers can verify delegation instead of trusting the agent's word.

Two 2026 developments matter. First, the v0.2 release (April 2026) restructured the mandate model — the original "intent mandate vs cart mandate" pair you'll still see described in most 2025 explainers was replaced by Checkout Mandates (open or closed) linked to Payment Mandates carrying granular constraints: budget, amount range, recurrence, allowed payee, execution date. Second, Google donated AP2 to the FIDO Alliance — the body behind passkeys — where the payments working group is now co-chaired by Mastercard and Visa, with Mastercard contributing its Verifiable Intent framework. AP2 is no longer a Google protocol; it's on track to become the neutral authorization standard. For the full mechanics — the mandate types, the five roles and how a transaction flows — see our AP2 Protocol Explained guide.

x402 — the machine settlement layer

x402, launched by Coinbase in May 2025, revives the HTTP status code 402 Payment Required: a server quotes a price in the 402 response, the agent retries with a signed payment in an X-PAYMENT header, and a facilitator settles it on-chain (overwhelmingly in USDC) in under a second. It became AP2's stablecoin settlement path, and in April 2026 Coinbase contributed it to the Linux Foundation's new x402 Foundation — whose members include Visa, Mastercard, American Express, Stripe, Google, Microsoft and AWS.

The honest version of x402's numbers: the Foundation reports 169M+ payments across 590,000 buyers and 100,000 sellers in its first year — but Chainalysis showed that the protocol's famous October 2025 volume explosion was driven largely by memecoin pay-to-mint speculation, and daily volume crashed more than 90% into early 2026 before recovering on healthier usage (transactions above $1 went from 49% to 95% of volume). The structural signal is stronger than the raw counts: since June 2026, AWS CloudFront and WAF support x402 natively, and Cloudflare has a Monetization Gateway on a waitlist — the two biggest edge networks are making 402 a normal response any production agent must know how to handle.

ACP — the checkout layer that outlived its flagship

The Agentic Commerce Protocol (ACP), open-sourced by OpenAI and Stripe in September 2025, powered the most famous agentic commerce product of 2025: Instant Checkout in ChatGPT. It is also the source of the most important correction in this guide: Instant Checkout no longer exists. OpenAI wound it down around March 2026, roughly five months after launch — in-chat checkout converted at about a third the rate of sending shoppers to the merchant's own site (per Walmart's EVP, reported by CNBC), and fewer than 30 Shopify merchants ever went live. OpenAI's current model is "discover in AI, buy on site," plus retailer-built ChatGPT apps (Target, Instacart, Booking.com).

The spec, however, survived the product: ACP keeps evolving (current stable version: April 2026), its Delegated Payments design — single-use, merchant-scoped, amount-capped payment tokens — remains the reference for scoped agent payment credentials, and PSPs beyond Stripe have reportedly been building implementations.

UCP — the commerce layer

Google's Universal Commerce Protocol (UCP), announced in January 2026 and co-developed with Shopify, Etsy, Target, Wayfair and Walmart, handles the merchant side: catalogs, carts and agentic checkout across Google's AI surfaces. Its May 2026 Universal Cart update added cross-retailer carts, BNPL through Affirm and Klarna — and a tech council that now includes Amazon, Meta, Microsoft, Salesforce and Stripe. Notably, the AP2 spec now describes itself as operating "as a security feature within a Commerce Protocol": authorization (AP2) inside commerce (UCP), with x402 available underneath for machine settlement.

Where MCP fits

The Model Context Protocol (MCP) — donated by Anthropic to the Linux Foundation in December 2025 — is not a payments protocol; it's how agents call external tools at all. It matters here because payment capabilities increasingly ship as MCP servers (PayPal's Agent Toolkit, Mastercard's Agent Toolkit, Cloudflare's x402 integration), which makes MCP the distribution channel through which agents acquire the ability to spend.

What the payment networks shipped

The card networks decided early that agent payments would run on their rails, and 2025–2026 was a steady drumbeat of infrastructure:

Visa announced Intelligent Commerce in April 2025 — tokenized "AI-Ready Cards" so agents never hold raw card details, with consumer-set spending limits and controls — followed by the Trusted Agent Protocol (agent identity for merchants, aligned with the IETF's Web Bot Auth work) and, in June 2026, a direct partnership with OpenAI. Reality check: as of July 2026 it remains in pilots — Visa reported "hundreds" of completed agent transactions in December 2025 and targets mainstream adoption by the 2026 holiday season.

Mastercard unveiled Agent Pay in April 2025, built on Agentic Tokens; the first live transaction settled in September 2025, country-first consumer transactions followed in Australia and New Zealand in early 2026, and in June 2026 it launched Agent Pay for Machines (AP4M) for high-frequency machine-to-machine micropayments settling across cards, accounts and stablecoins.

PayPal built the middleware position: an Agent Toolkit exposing payments via MCP, Agentic Commerce Services that make a merchant's catalog shoppable across AI surfaces, the payments engine behind Microsoft's Copilot Checkout (January 2026), and the Cymbio acquisition (February 2026) to syndicate brand catalogs into Copilot and Perplexity.

American Express shipped an agentic commerce developer kit in April 2026 with purchase protection for registered agent-initiated transactions — the first network to lead with the liability question.

Amazon, characteristically, skipped the open protocols: its Alexa for Shopping assistant (which replaced Rufus in May 2026) and Buy for Me / Shop Direct programs complete purchases even on third-party sites — Amazon-reported figures credit its shopping AI with roughly $12B in annualized incremental sales.

Agentic commerce by the numbers

The credible, sourced figures as of July 2026 — with their caveats:

• 20% of global online orders during the 2025 holiday season were influenced by AI and agents, worth $262B, per Salesforce ($67B in Cyber Week alone). "Influenced" includes AI-assisted discovery, not only agent-completed checkout.
• Traffic to US retail sites from generative AI grew 693% year over year in the 2025 holidays, and is up more than 1,300% since late 2024, per Adobe — off a base Adobe itself calls modest. AI-referred shoppers convert ~54% better than average.
• 169M+ payments in year one for x402, the only protocol publishing volume — with the memecoin caveat above. Neither AP2 nor ACP has published any transaction figures.
• $1T in US retail revenue by 2030 ($3–5T globally) is McKinsey's projection for agent-orchestrated commerce; Gartner projects 90% of B2B buying will be agent-intermediated by 2028. Treat both as scenario numbers, not measurements.

The pattern behind the numbers: discovery-side adoption (people and agents researching purchases through AI) is growing explosively and measurably; autonomous checkout is much earlier, still gated on the authorization and trust infrastructure described above.

The risks nobody prices in

The uncomfortable part of the 2026 record is that its best-documented failures are not hypothetical:

1. Agents are bad with money by default. Anthropic's Project Vend — Claude autonomously running a real small business — sold items below cost, gave away discounts, and once hallucinated a payment account. Phase 2 showed that procedural guardrails largely fixed profitability, but the agent remained vulnerable to social engineering by determined humans.
2. Payment-directed prompt injection is now in the wild. In July 2026, Zscaler documented live campaigns that tricked AI agents into sending crypto payments via poisoned packages and typosquatted sites — several of the 26 models tested paid.
3. Authorization is legally unsettled. Amazon v. Perplexity is testing whether a user's authorization lets an agent shop a platform that forbids it — injunction granted in March 2026, stayed on appeal, argued before the Ninth Circuit in June, undecided as of this writing. Liability for agent-initiated chargebacks is similarly unresolved.
4. The economics can quietly fail. Instant Checkout didn't die from a security incident — it died from conversion rates. Merchants also pushed back on Amazon's Buy for Me listing and selling their products without consent.
5. Reconciliation is nobody's product. Agents generate thousands of micro-transactions across multiple wallets, providers and rails; neither AWS nor Cloudflare has addressed seller-side tax or invoicing for paid agent traffic, and the accounting stack for agent spend is largely missing.
6. Regulation is arriving on a schedule. The bulk of the EU AI Act's high-risk obligations become enforceable in August 2026, and the UK's FCA has signaled that transacting agents will need clear accountability and human oversight.

How to keep agent spending under control

Look closely at what every serious player shipped in 2025–2026 and the same control vocabulary repeats. AP2's Payment Mandates encode budgets, amount ranges, recurrence, allowed payees, execution dates. Visa's Intelligent Commerce leads with spending limits and approved merchant categories. Mastercard's AP4M lists permissioning as a core capability. The industry has converged on what "safe agent spending" means; the checklist for anyone deploying agents that spend:

1. One identity and wallet per agent — never a shared card or a pooled wallet you can't attribute.
2. Hard budgets per agent, per day and per month, enforced outside the agent's own reasoning (an agent that can be prompt-injected can't be its own guardrail — see Zscaler above).
3. Merchant and category allowlists — the single most effective control against both injection and drift.
4. Human approval thresholds — autonomous below a limit, held for sign-off above it.
5. A kill switch that freezes one agent, or everything, immediately.
6. A complete audit trail — every transaction attributable to an agent, a policy and a principal, exportable to your accounting system.
7. A cross-provider view — real fleets spread across Coinbase CDP, Privy, Turnkey and MetaMask wallets; controls that only cover one provider aren't controls.

This governance layer — budgets, approvals, kill switch and audit trails across every agent wallet, without holding your funds — is exactly what AgentLedger builds. You can see it working on synthetic data in the live demo.

Where agentic commerce goes next

The second half of 2026 has visible milestones: Visa's stated target of mainstream agent payments by the holiday season; EU AI Act enforcement from August; the FIDO working groups' first interoperable outputs for agent authentication and payments; the IETF's Web Bot Auth best-practices milestone; and the question of whether the 140-company "Open USD" stablecoin consortium becomes the default settlement asset for machine payments. The protocol map will keep shifting — we track it every two weeks in our Agentic Commerce News roundup.

The safest prediction is structural: delegation of spending to software is growing at every layer — consumer, corporate and machine-to-machine — and every credible actor is building the same thing around it: identity, mandates, limits and audit. The agent economy's real currency is authorized trust.

Frequently asked questions

What is an example of agentic commerce today?

Amazon's Alexa for Shopping completing a purchase on a third-party site; Google's agentic checkout buying from Wayfair or Chewy through Google Pay in AI Mode; a research agent paying a data API per request through an HTTP 402 response settled in USDC. All three run in production in 2026.

How is agentic commerce different from e-commerce?

E-commerce digitized the store but kept a human driving every step. Agentic commerce delegates the steps themselves — discovery, decision and payment — to software operating under constraints. The defining artifacts are new: mandates (proof of delegated authority), agent identity credentials, and per-agent spending policies.

What is AP2?

The Agent Payments Protocol: an open standard, started by Google and now governed by the FIDO Alliance, for cryptographically provable payment authorization. Users sign Checkout and Payment Mandates that encode what an agent may buy and under which constraints (budget, payee, expiry), so merchants and issuers can verify delegation instead of trusting the agent. We break it down in full in AP2 Protocol Explained.

What is x402?

An open protocol, started by Coinbase and now under the Linux Foundation, that revives HTTP status 402 for machine payments: a server quotes a price, the agent pays per request (typically in USDC), a facilitator settles on-chain in under a second. Since mid-2026, AWS CloudFront/WAF support it natively — it's how APIs and content charge AI agents without accounts or subscriptions.

Is it safe to let an AI agent spend money?

Not without external controls. The documented failure modes — agents mispricing (Project Vend), in-the-wild prompt-injection payment attacks (Zscaler, July 2026), unsettled legal authority (Amazon v. Perplexity) — all argue for guardrails that live outside the agent: hard budgets, allowlists, approval thresholds, a kill switch and a full audit trail. With those in place, agent spending becomes a bounded, auditable delegation rather than an open credit line.