In March 2026, OpenAI retired Instant Checkout. About a dozen Shopify merchants had ever shipped against it. The feature died; the protocol underneath it did not. That gap — between a standard that keeps advancing and merchants who never wired it up — is the most useful thing that happened in agentic commerce this year, because it tells you exactly what to build and what to ignore.
The problem agentic commerce actually solves
Agents were already buying things before any of this existed. They did it the ugly way: scraped credentials, stored cards, headless browsers driving a checkout form built for a human thumb. It worked often enough to be dangerous. What it could not do was answer four questions that every payment network needs answered before it will accept liability.
- Who is the buyer? Not the agent — the human whose money is moving.
- What authority did the agent have? “Buy running shoes under 120 dollars” is a different mandate from “buy this exact cart”.
- Did the cart change between intent and payment? Price, quantity, shipping, substitutions.
- Who eats the loss when it goes wrong? Merchant, network, issuer, or the agent’s operator.
Every serious specification released since late 2025 is an attempt to make those four answers machine-verifiable. Once you see it that way, the competing standards stop looking like rival products and start looking like different bets on where the trust boundary sits.
The two specifications that matter
ACP — the merchant integration
The Agentic Commerce Protocol was co-developed by OpenAI and Stripe and published under Apache 2.0 on 29 September 2025. Its centre of gravity is the merchant. One integration exposes your catalogue, your cart logic and your order lifecycle to any agent that speaks the protocol, while you keep control of pricing, brand presentation and fulfilment. It is deliberately payment-provider agnostic — businesses that do not process with Stripe can adopt it with their existing processor, and PayPal announced adoption in October 2025 to power in-chat payments.
The spec has not stood still. The 2026-04-17 release added cart, feed, orders and authentication surfaces, plus compatibility with the Model Context Protocol — which means an ACP merchant surface is reachable by the same agent plumbing enterprises are already deploying for internal tools.
AP2 — the payment mandate
Google’s Agent Payments Protocol arrived on 16 September 2025 with more than 60 launch partners including Mastercard, PayPal, Coinbase, American Express and Salesforce. Its centre of gravity is the transaction, not the storefront. Every agent purchase is decomposed into three signed mandates carried as W3C Verifiable Credentials: an Intent Mandate (what the user authorised), a Cart Mandate (what the agent assembled) and a Payment Mandate (what actually gets charged). Stablecoin rails are treated as first-class alongside cards and bank transfer.
The design goal is narrow and important: give a network a cryptographic way to tell an agent-initiated transaction from a human one, and to prove the agent stayed inside its authority. That is a dispute-resolution primitive more than a shopping feature.
How they compare
| Dimension | ACP (OpenAI + Stripe) | AP2 (Google) |
|---|---|---|
| Primary actor | Merchant | Payment network / issuer |
| What it standardises | Catalogue feed, cart, order lifecycle, auth | Signed intent, cart and payment mandates |
| Trust mechanism | Merchant-controlled APIs and auth | W3C Verifiable Credentials |
| Settlement rails | Existing processor | Cards, bank transfer, stablecoins |
| Licence / governance | Apache 2.0, spec on GitHub | Open spec, large partner consortium |
| Are they rivals? | Not structurally. ACP describes how an agent talks to your store. AP2 describes how the resulting payment proves it was authorised. A mature stack ends up carrying both. | |
A third layer is forming underneath: x402 revives the dormant HTTP 402 status code for machine-to-machine micropayments, and card networks have shipped their own agent credentials — Visa’s Trusted Agent Protocol and Mastercard Agent Pay. These matter for API operators and publishers charging per call far more than they matter for a retailer.
What to do if you sell online
The order of work is not the order of excitement. Ranked by what actually blocks an agent today:
- Fix the feed before the checkout. An agent cannot buy what it cannot parse. Stock status, variant-level pricing, shipping cost and return window need to be machine-readable and accurate to the minute. Most merchants fail here and never find out, because the failure looks like silence.
- Expose an order API, not an order page. Confirmation, status and cancellation need endpoints. If the only way to check an order is a logged-in HTML page, the agent’s job ends at purchase and every follow-up becomes a support ticket.
- Decide your authentication story. Delegated tokens with explicit scope and expiry. If your answer is “the agent logs in as the customer”, you have not decided — you have deferred.
- Then implement a protocol. ACP first if you sell goods; add AP2 mandate verification when your acquirer supports it.
What to do if you do not sell online
Most B2B sites read all of this and conclude it is somebody else’s problem. That is a mistake with a specific shape. The primitives — verifiable intent, scoped authority, a machine-readable surface, a callable action — are identical whether the transaction is a 90 dollar cart or a 90,000 dollar RFP. If an agent researching vendors on behalf of a procurement lead can read your capability page, retrieve your pricing model and submit a scoped enquiry, you are in the consideration set. If it hits a contact form built for a human, you are not.
This is the same discipline we describe in letting an agent complete a task on your site and in the discovery layer — machine-readable surface first, action second.
The honest read on timing
McKinsey’s estimate that agentic commerce could influence 3 to 5 trillion dollars of global commerce by 2030, including up to 1 trillion of orchestrated US B2C retail revenue, is doing a lot of work in vendor decks right now. Treat it as a directional forecast, not a procurement trigger. The observable fact is narrower and more instructive: the specifications are converging and shipping quarterly releases, while merchant implementation is thin enough that a single retired feature took most of the visible volume with it.
That combination is what an early standard looks like from the inside. It also means the cost of being early is unusually low. Feed hygiene, an order API and scoped delegated auth are things you should own regardless of which protocol wins — they are not bets, they are hygiene. The protocol adapter on top is a few weeks of work you can do once the answer is obvious.
Frequently asked questions
Do I have to choose between ACP and AP2?
No. They operate at different layers. ACP standardises how an agent interacts with your storefront; AP2 standardises how the resulting payment proves it was authorised. Implementing ACP does not preclude accepting AP2 mandates, and most mature stacks will carry both.
Is Instant Checkout being retired a sign agentic commerce failed?
It is a sign the consumer surface was ahead of merchant integration. The ACP specification continued shipping releases after the retirement, including the 2026-04-17 version that added orders, authentication and MCP compatibility. Standards routinely outlive the first product built on them.
What is the minimum viable step for a mid-sized retailer?
An accurate, minute-fresh product feed with variant-level price and stock, plus an order status endpoint. Those two things determine whether an agent can transact with you at all. Protocol adoption is the second move, not the first.
Does any of this apply to a services business?
Yes, in the form of scoped enquiry rather than checkout. The requirement is the same — a machine-readable description of what you sell and a callable way to start a conversation that does not depend on a human filling in a form.