AI Agent Payment Protocols in 2026: ACP, AP2, Visa Trusted Agent Protocol, and Mastercard Agent Pay Compared

01. The Quick Answer: Four Standards, Four Different Jobs

• ACP: how an agent requests and completes a purchase using a delegated payment token, built by OpenAI and Stripe.
• AP2: Google's cross-network protocol for authorizing payments an agent initiates without a person clicking buy, now governed by the FIDO Alliance.
• Visa Trusted Agent Protocol and Mastercard Agent Pay: network-level trust and credential layers that verify an agent is legitimate, not a scraper or a fraudulent bot.
• Best first move: confirm what your existing payment processor already supports before assuming any of this needs new engineering work.

02. At a Glance: ACP, AP2, Visa TAP, and Mastercard Agent Pay Compared

Why it matters: ACP and AP2 decide how a payment gets authorized, while Visa's and Mastercard's protocols decide whether the agent making the request should be trusted at all. A merchant can be affected by the trust layer well before ever touching a payment authorization spec directly.

03. Why This Matters Now, Not Just for Large Enterprises

Shopify's own agentic storefront channels are already live for eligible merchants, which means AI-driven shopping traffic is reaching Canadian stores whether the payment protocols behind it are finalized or not. Every major payment network and AI lab shipped real movement on this in 2026: ACP's latest spec build in April, AP2's version 0.2.0 the same month followed by the FIDO Alliance handoff, Visa targeting the 2026 holiday season for Trusted Agent Protocol, and Mastercard expanding Agent Pay for Machines to more than 30 partners in June. None of that activity is limited to large retailers with dedicated engineering teams.

Why it matters: a small Canadian manufacturer or DTC brand selling on Shopify is exposed to this whether or not it has done anything specific to enable it, since the trust and payment layers sit underneath the platform, not on top of it.

04. ACP: OpenAI and Stripe's Protocol, and What the Instant Checkout Pullback Actually Meant

The Agentic Commerce Protocol is an open specification, built jointly by OpenAI and Stripe, that defines how an AI agent requests a purchase and completes it using a delegated payment token rather than handling a shopper's card details itself. It is the plumbing behind ChatGPT's commerce integrations with merchants, including Shopify and Etsy sellers, and it is designed so other AI platforms and payment providers can adopt it too, not just OpenAI and Stripe.

Why it matters: OpenAI scaling back its original Instant Checkout ambitions was a change to a specific consumer-facing feature, not the end of ACP itself. The protocol still exists and still moves purchases through it, even though the earlier vision of a purchase completing entirely inside a chat window did not hold up as originally pitched.

05. AP2: Google's Cross-Network Protocol and the Move to the FIDO Alliance

AP2, the Agent Payments Protocol, takes a broader approach than ACP. Rather than being built around one specific commerce integration, it defines how a payment initiated by an agent instead of a person, what Google calls a human not present payment, gets authorized across any payment rail: cards, bank transfers, or stablecoins. Google shipped version 0.2.0 in April 2026 and then donated the protocol to the FIDO Alliance, the same body behind passkey standards, so it would be governed as a neutral, cross-industry standard rather than staying tied to one company's roadmap.

Why it matters: a protocol governed by an industry body instead of a single vendor is more likely to become the kind of shared standard that payment processors and platforms eventually build support for by default, similar to how passkeys spread once FIDO took them on.

06. Visa Trusted Agent Protocol and Mastercard Agent Pay: The Trust Layer Underneath

Visa's Trusted Agent Protocol, built together with Cloudflare, solves a different problem than ACP or AP2. Instead of governing how a payment is authorized, it verifies that an AI agent making a request is actually a legitimate shopping assistant and not a scraper, a credential-stuffing bot, or a fraudulent script. Visa is targeting mainstream rollout in time for the 2026 holiday shopping season. Mastercard Agent Pay covers similar ground for its own network, and Mastercard expanded the program in June 2026 with Agent Pay for Machines, adding on-chain permissioning across networks including Polygon, Solana, and Base for more than 30 partner companies, among them Coinbase, Stripe, and Adyen, so agents can transact machine to machine without a person approving each individual purchase.

Why it matters: this trust layer is the one most likely to affect a small Canadian merchant first, since it directly decides whether a fraud rule or a firewall blocks legitimate AI shopping traffic before an actual payment protocol ever comes into play.

07. Do You Need to Integrate Any of This Yourself?

For nearly every Canadian manufacturer, wholesaler, retailer, or DTC brand, the answer is no, not directly. Shopify, Stripe, and the major card networks are the ones implementing ACP, AP2, and the network trust layers into the checkout and payment infrastructure merchants already use. A store does not need custom code to accept ACP-based payments any more than it needed custom code to accept a new card network years ago. The real, practical work is confirming current support with your processor and platform, and making sure fraud rules and analytics can tell agent-driven orders apart from ordinary traffic instead of quietly blocking or mislabeling them.

Why it matters: treating this as a build problem wastes engineering time a small business does not have. Treating it as a configuration and monitoring problem is the accurate read for 2026.

08. A Checklist for What to Actually Do in 2026

• Ask your payment processor which protocols it already supports. Stripe, and the major card networks issuing cards to your Canadian customers, are the ones implementing ACP, AP2, and the network trust layers underneath your checkout. Confirm current support rather than assuming any specific protocol is or is not active on your account.
• Separate bot-blocking from agent-blocking in your fraud and security rules. A rule written to stop scrapers and credential-stuffing bots can just as easily block a legitimate AI shopping agent acting on a real customer's behalf. Review current fraud rules and firewall settings, including Cloudflare configuration if you use it, with this distinction in mind.
• Do not commit engineering time to a single protocol yet. ACP, AP2, and the two network-level trust protocols are not consolidated into one standard, and it is still unclear which will dominate for a given use case. Treat direct protocol integration as premature unless you are already selling actively through a specific AI commerce channel.
• Tag and monitor orders that arrive through AI shopping channels. Whether traffic is arriving through Shopify's agentic storefront channels or a future protocol-driven checkout, tag it separately in your analytics so you can see conversion rate, average order value, and return rate differences early rather than discovering them months later.
• Keep product data and payment settings accurate regardless of protocol. Every one of these standards depends on an agent being able to read accurate pricing, tax, and availability data and complete a payment against settings that are actually current. That groundwork pays off no matter which protocol ends up carrying the transaction.

Why it matters: almost every item on this list is a configuration, monitoring, or fraud rule review, not a development project, which keeps it realistic for a lean team to work through this year.

09. How AtlanticWorks Helps

AtlanticWorks is a certified Shopify, HubSpot, Google, and Salesforce partner working with manufacturers, wholesalers, retailers, and DTC brands across Atlantic Canada, the rest of Canada, and the US. We audit which of these agent payment and trust protocols are already active on your Shopify and payment processor setup, review fraud rules so legitimate AI shopping traffic is not blocked at checkout, and connect the resulting order data back into your CRM so sales and finance can see agent-driven orders clearly. It starts with a free assessment of your current checkout and payment setup.

10. Key Takeaways

• ACP, built by OpenAI and Stripe, governs how an agent requests and completes a purchase using a delegated payment token, and it is already live in ChatGPT commerce integrations.
• AP2, Google's cross-network protocol, authorizes human not present payments across cards, bank transfers, and stablecoins, and was donated to the FIDO Alliance in 2026 for neutral governance.
• Visa's Trusted Agent Protocol and Mastercard's Agent Pay operate at the identity and trust layer, verifying that an AI agent is legitimate rather than a scraper or fraudulent bot.
• Mastercard Agent Pay for Machines extends agent payments to machine to machine transactions, expanding in June 2026 with more than 30 partners including Coinbase, Stripe, and Adyen.
• Almost none of this requires a Canadian merchant to build anything directly. The practical work is confirming what your processor already supports and keeping fraud rules from blocking legitimate agent traffic.