In short. Agent Payments Protocol links user permission to agent purchases through signed mandates checked by merchants and payment providers.

Definition: Agent Payments Protocol (AP2) is an open protocol for proving that a user authorises an AI agent to make a purchase and its associated payment. It uses signed mandates, records of the actions the user permits, that merchants and payment providers verify.

Key facts

Google's launch announcement, dated 16 September 2025, describes Intent Mandates for shopping instructions and Cart Mandates for the selected purchase.
As of 17 October 2026, the AP2 specification defines Checkout Mandates and Payment Mandates, with separate responsibilities for merchants and payment providers.
Google's April update, dated 28 April 2026, announces version 0.2 and the protocol's donation to the FIDO Alliance.

How do authorisation mandates work?

The Agent Authorization Framework separates permission into delegation and verification. During delegation, the user approves the mandate's contents on a Trusted Surface, an interface responsible for obtaining informed consent. The agent retains the resulting mandate. During verification, a receiving party checks the agent's proof of permission and returns a receipt recording the outcome.

A closed mandate approves a specific transaction. An open mandate permits a transaction subject to constraints that the agent must satisfy later. The Checkout Mandate documentation defines restrictions on permitted merchants and acceptable line items. The merchant checks the purchase against these restrictions.

The Payment Mandate documentation defines payment restrictions, including an amount range and an execution date range. Implementers can identify open and closed mandates by the following values of the vct field, which identifies the credential type:

mandate.checkout.1
mandate.checkout.open.1
mandate.payment.1
mandate.payment.open.1

These are type identifiers for signed mandate structures. The version suffix forms part of each identifier.

What happens during payment?

The flow examples describe a direct purchase in which the merchant signs the checkout details. The user then approves the closed Checkout and Payment Mandates through the Trusted Surface.

The agent sends the Payment Mandate to the credential provider, the party supplying the payment credential. After verification, that provider supplies a payment token. The agent passes the token and Checkout Mandate to the merchant. The merchant checks the purchase and initiates payment; its payment processor verifies the payment authorisation and its connection to the checkout. Signed checkout and payment receipts record the result.

For an autonomous purchase, the user first approves open mandates. Later, the agent signs closed mandates for a matching purchase and presents both the open permissions and the closed transaction records. The same examples describe an unresolved_constraint error that can bring the user back to approve the transaction directly.

What does AP2 cover for a merchant website?

The specification places AP2 inside a commerce protocol as a security feature. Catalog interfaces, checkout updates and communication interfaces belong to the surrounding commerce protocol. AP2 explicitly supports integration with Universal Commerce Protocol (UCP).

A merchant implementing AP2 must obtain and verify a Checkout Mandate before completing checkout. Verification includes comparing the approved checkout's cryptographic hash, a value derived from its contents, with the mandate's recorded value and checking applicable constraints. The specification permits a merchant to delegate verification to a technology provider, such as its payment processor.

FAQ

Can an agent pay while I am absent?

The autonomous flow uses open mandates you approve beforehand. The agent later presents the constrained permissions alongside the signed records of the particular transaction.

Does AP2 require a particular payment method?

The specification allows different payment instruments through an extension mechanism. Each instrument has a type identifier and can carry additional properties for that payment method.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer