ACP vs UCP vs AP2: The Agentic Commerce Protocols Compared

ACP, UCP and AP2 in one paragraph each

The agentic commerce protocols are open specifications that let an AI agent buy from a merchant on a shopper's behalf. Three of them come up in almost every conversation about agentic commerce, and they do not compete as directly as the acronyms suggest.

• ACP, the Agentic Commerce Protocol, was released by OpenAI and Stripe on 29 September 2025 to power checkout inside ChatGPT (Stripe). It defines how an agent and a merchant run a checkout and how a payment credential passes between them. Since April 2026 it also covers carts, product feeds and orders.
• UCP, the Universal Commerce Protocol, was announced by Google on 11 January 2026 with Shopify, Etsy, Wayfair, Target and Walmart (Google). It covers the whole journey: catalog, cart, checkout, account linking and orders. It runs checkout in Google AI Mode and Gemini.
• AP2, the Agent Payments Protocol, was announced by Google on 16 September 2025 with more than 60 payments and technology companies (Google Cloud). It does not run a checkout. It produces signed proof that the shopper authorised a specific purchase, so a merchant, a processor and a card issuer can trust an agent-initiated payment.

So ACP and UCP overlap: both carry a checkout from an agent to your store, for different AI surfaces. AP2 sits one layer down, at payment authorisation, and UCP already references it.

What is the Agentic Commerce Protocol (ACP)?

The Agentic Commerce Protocol is the standard behind shopping in ChatGPT. Stripe describes it as a merchant-friendly open standard that it co-developed with OpenAI, and says merchants who do not process with Stripe can adopt it with their existing payment provider (Stripe, 29 September 2025). Whether you hear it called the OpenAI agentic commerce protocol or the Stripe agentic commerce protocol, it is one specification.

How it works. The merchant implements a small checkout API: create, update, retrieve, complete and cancel a checkout session, plus signed webhooks that report when an order is created or updated (OpenAI checkout spec). Payment uses a delegated credential. Stripe issues a Shared Payment Token after the buyer pays with a saved method. The token is scoped to one merchant and one basket total, so the agent never sees the card number. The merchant charges it through Stripe or another processor, accepts or declines the order, and handles tax, fulfilment and returns.

Governance and status. The ACP GitHub repository is Apache 2.0, names OpenAI and Stripe as founding maintainers, and states a path toward neutral foundation stewardship. As of October 2026 it marks the specification as beta. The latest stable version is dated 2026-04-17 and added cart, feed, orders, authentication and MCP support. Earlier versions in January 2026 added capability negotiation, extensions, discounts and payment handlers.

Who uses it. ChatGPT first, through Instant Checkout from September 2025. In March 2026 OpenAI scaled in-chat checkout back and moved its focus to discovery. An OpenAI spokesperson said at the time that ACP would serve as "the infrastructure that connects users to merchants" (Digital Commerce 360, 6 March 2026). The full story is in what happened to ChatGPT Instant Checkout. Microsoft's Copilot Checkout also runs partly on ACP: Stripe says it connects Copilot to sellers through the protocol (Stripe, 8 January 2026). PayPal announced in October 2025 that it would adopt ACP for ChatGPT checkout (PayPal).

What is the Universal Commerce Protocol (UCP)?

UCP is Google's answer to the same problem, built wider. A store publishes a profile at /.well-known/ucp listing the capabilities it supports, and agents negotiate from there. The specification at ucp.dev lists Catalog, Cart, Checkout, Identity Linking and Order for shopping, with draft work for lodging and food ordering. Transport bindings exist for REST, MCP and A2A (Google Developers Blog).

UCP has the broader coalition. Amazon, Meta, Microsoft, Salesforce and Stripe joined its Tech Council in April 2026, alongside founding members Google, Shopify, Etsy, Target and Wayfair (press release, 24 April 2026). Stripe now sits in both camps.

In production, UCP runs checkout in Google AI Mode, Gemini and Google's Universal Cart in the US, and Shopify storefronts publish UCP profiles. The merchant stays seller of record. For the merchant-side details (Merchant Center attributes, excluded products, the checkout flow) read UCP explained for merchants.

What is Google's Agent Payments Protocol (AP2)?

AP2 answers a question the checkout protocols leave open: when an agent pays, how does anyone prove the human agreed? Google's answer is the mandate, a tamper-proof, cryptographically signed record of the shopper's instruction, issued as a verifiable credential (Google Cloud, 16 September 2025).

The model has changed since launch, so check which version a vendor means:

• At launch (September 2025) Google described an Intent Mandate, which captures the request and its rules, and a Cart Mandate, which the shopper signs when approving a specific cart. The payment method is then bound to the approved cart.
• In version 0.2 (April 2026) the specification is organised around a Checkout Mandate and a Payment Mandate. Each has an open stage, which holds the shopper's limits such as budget and allowed payment methods, and a closed stage, which holds approval of one finalised checkout and amount.

Both versions support two modes. With the human present, the shopper sees the final cart and approves it. With the human not present, the shopper approves a set of constraints in advance, and the agent builds the final mandates inside those limits, for example buying concert tickets the moment they go on sale.

AP2 is payment-method agnostic. Google lists cards, real-time bank transfers and stablecoins, and an x402 extension handles crypto payments. On 28 April 2026 Google contributed AP2 to the FIDO Alliance, together with Mastercard's Verifiable Intent framework, which Mastercard co-developed with Google to work with AP2 (FIDO Alliance). Development continues in FIDO's new Payments Technical Working Group, chaired by members from Mastercard and Visa. The public implementation is pre-1.0. We found no published figures on AP2 transactions in production as of October 2026.

ACP and UCP decide where the order goes. AP2 decides whether anyone can prove the shopper meant it.

Jakub Riegel

Comparison table

Sources for each row are linked in the sections above. Status lines change often, so check the repositories before you plan around them.

Where Visa and Mastercard fit

The card networks run their own agent programmes. They sit next to the protocols above, not in place of them.

• Visa. Visa launched Visa Intelligent Commerce on 30 April 2025. On 14 October 2025 it introduced the Trusted Agent Protocol, developed with Cloudflare. Agents sign their requests so merchants can tell a trusted shopping agent from a malicious bot. The signature can carry the agent's intent, whether the shopper already has an account with the merchant, and optional payment data. It builds on HTTP Message Signatures and aligns with Web Bot Auth.
• Mastercard. Mastercard announced Agent Pay on 29 April 2025. It introduced Agentic Tokens, an extension of the tokenisation already used for card-on-file and mobile payments. Its Verifiable Intent framework went to the FIDO Alliance alongside AP2.

For most merchants these programmes arrive through the acquirer, the payment provider or the bot-management layer, not as a separate build.

Which agentic commerce protocol should a merchant implement?

Usually not one by choice. The surface you want to sell on picks the protocol, and your platform often implements it for you.

1. To sell inside Google AI Mode and Gemini, you need UCP checkout. On Shopify, Agentic Storefronts handles it for eligible US stores (see Shopify and agentic commerce). Elsewhere, start in Merchant Center.
2. To be found in ChatGPT, you need your products in its index. That means an ACP product feed through OpenAI's merchant programme, Shopify Catalog or a feed partner. Checkout mostly happens on your own site today.
3. For Copilot Checkout, Stripe, PayPal and Shopify are the routes, each with its own enrolment.
4. For autonomous purchases, AP2 comes through your payment provider once it supports mandates. There is little for a merchant to build directly yet.

If you run a custom stack, the cheapest path is one internal checkout service that answers the same questions both standards ask: what is in the cart, what it costs with tax and shipping, whether it is in stock, and whether you accept the order. Both ACP and UCP model a checkout as a session that is created, updated and completed. In our reading of the two specifications, a clean internal service maps onto both with thin adapters. Payment providers are already building those adapters: as of October 2026, Stripe's documentation covers its ACP-based tools and UCP side by side.

Whichever protocol wins a given surface, the data underneath is shared. Agents rank what they can read, so the work that pays everywhere is the work on your catalog. Our guides on what AI commerce is and why structured product data decides AI visibility cover that layer. More protocol coverage sits on the AI shopping agents topic page.

FAQ

What is the Agentic Commerce Protocol?

ACP is an open standard, co-developed by OpenAI and Stripe and released on 29 September 2025, that lets an AI agent run a checkout with a merchant and pass a scoped payment token. It is Apache 2.0 licensed and, as of October 2026, in beta.

Is ACP the same as UCP?

No. Both carry a checkout from an AI agent to a merchant, but ACP comes from OpenAI and Stripe and powers ChatGPT and Stripe's Copilot Checkout, while UCP comes from Google and its retail partners and powers Google AI Mode and Gemini.

What is Google's Agent Payments Protocol (AP2)?

AP2 is a payment authorisation protocol Google announced in September 2025. It uses cryptographically signed mandates to prove what a shopper approved, either a specific cart or limits set in advance. Google contributed it to the FIDO Alliance in April 2026.

Does a merchant need to implement AP2?

Rarely, today. AP2 is handled mostly by payment providers and agent platforms. A merchant feels it when its payment provider starts accepting mandates for purchases where the shopper is not present.

Which AI platforms use ACP?

ChatGPT uses ACP for product feeds and merchant integrations, and Stripe uses it to connect sellers to Microsoft Copilot Checkout. PayPal announced ACP support for ChatGPT in October 2025.