Agentic Commerce Protocol (ACP) Explained: How It Works and What Actually Shipped

The Agentic Commerce Protocol (ACP) is an open source standard, co-developed by OpenAI and Stripe and published on September 29, 2025, that lets an AI agent complete a purchase on a merchant's behalf without a custom integration for every retailer. It defines a shared checkout API, a payment handler framework for passing tokenized payment credentials, and a data model for carts, orders, and fulfillment, so a merchant builds one integration and any ACP-compliant agent can use it.

ACP launched paired with ChatGPT's Instant Checkout feature, with Etsy live on day one for US buyers and Shopify positioned as coming soon. Five months later, the flagship product that introduced most people to ACP was mostly gone. That gap between the announcement and what actually shipped is the most useful thing to understand about this protocol right now, more useful than the spec details alone.

Why ACP exists

Before ACP, an AI agent that wanted to complete a purchase had two bad options. It could scrape a retailer's site and guess at inventory, price, and shipping cost, which is unreliable and breaks the moment a page layout changes. Or a platform like OpenAI could hand-build a one-off integration with each retailer's checkout system, which does not scale past a handful of large partners and puts every smaller merchant outside the ecosystem.

ACP's answer is a standard interface: a merchant implements one REST API for checkout sessions, and any agent that speaks ACP can create, update, and complete an order against it, the same way any browser can render any website that speaks HTTP. The merchant stays the system of record for orders, payment, tax, and fulfillment. The agent never touches raw payment credentials directly, it passes a tokenized instrument through a defined payment handler.

The core mechanism

ACP's checkout flow runs on a REST API most backend teams will recognize immediately. A client, in practice ChatGPT so far, creates a checkout session with POST /checkout_sessions, sending line items and buyer details. The merchant's server responds with an authoritative cart: line items, taxes, fulfillment options, and a list of payment handlers it accepts, each one declaring whether it requires payment delegation and which PSP processes it.

The session then moves through update, retrieve, and complete steps, each one returning the full authoritative state so the agent and the merchant never disagree about what is actually in the cart. Every POST request requires an idempotency key, so a retried request cannot double-charge a buyer or double-create an order. When a card requires 3D Secure authentication, the session moves into an authentication_required state and the agent must complete that step before finishing the order.

Payment itself runs through a handler framework. Each handler, like dev.acp.tokenized.card, is a self-describing object naming its PSP, its config schema, and whether it requires the delegate_payment step, which vaults the buyer's real payment details and returns a constrained token (Stripe's Shared Payment Token is the first implementation) with a spending limit, currency, and expiry baked in. The agent only ever handles that token, not the underlying card number.

Discovery and negotiation happen through capabilities the merchant publishes upfront, covering payment methods, fulfillment types, and any required interventions the agent has to support. None of this requires an agent to run any specific model or framework. It is a REST contract, and the project has also added an MCP-compatible surface for merchants who want to expose the same capabilities through that protocol instead.

Real adoption versus what was announced

This is where ACP's story gets more interesting than most protocol explainers, because the honest answer changed dramatically within its first year.

At launch, OpenAI announced Etsy as live and said Shopify's more than one million merchants, naming Glossier, SKIMS, Spanx, and Vuori, were coming soon. By March 2026, according to reporting on comments from Walmart's Daniel Danker at Morgan Stanley's Technology, Media, and Telecom conference, only around 30 Shopify merchants had actually gone live inside Instant Checkout, not the million promised at launch. Walmart had listed roughly 200,000 products, a real number but a fraction of its catalog.

The bigger problem was conversion, not merchant count. Walmart's own data showed purchases completed natively inside ChatGPT converted at roughly a third the rate of purchases where the agent redirected the buyer to Walmart's own site to finish checkout. Forrester and Gartner analysts, quoted in the same reporting, pointed to two separate causes: OpenAI leaned on scraping and crawling for product data rather than structured feeds, which produced stale prices and stock levels, and merchant integration turned out to be far more work than the initial announcements implied.

By spring 2026, OpenAI, Walmart, Etsy, and Shopify had all pivoted away from native in-chat checkout toward a redirect model. Walmart built its own shopping assistant, Sparky, embedded inside ChatGPT and Google Gemini, that finds products and hands off to Walmart's own checkout, a flow Walmart reported converting at roughly 70 percent of its normal site rate, well above Instant Checkout's numbers. Etsy and Shopify moved toward the same pattern: ChatGPT surfaces the product, the buyer completes payment on the merchant's own site or app rather than inside the chat window.

None of that killed ACP itself. The specification kept shipping releases through at least April 2026, adding fulfillment options, capability negotiation, extensions, and cart and feed support. What it killed was the specific product bet that native, one-tap, in-chat checkout would be how most people actually buy things through an AI agent. If you are evaluating ACP today, treat the spec and its checkout API as real and actively maintained, and treat any specific retailer's "live in ChatGPT" claim as something to verify, since the retailers with the most experience running it chose to route payment back to their own sites instead.

As of today, ACP's own site states plainly that OpenAI remains the only AI platform to have implemented it with ChatGPT, and Stripe remains the only compatible payment processor, with its Shared Payment Token. PayPal has announced a "Pay with PayPal" integration for ChatGPT, but that is still an announced integration, not a second shipped PSP, as of this writing.

Governance: open source, not yet neutrally governed

ACP is Apache 2.0 licensed and anyone can open a pull request, propose a specification change, or build an implementation without a fee. That much is genuinely open. What is not yet true is that ACP has independent, vendor-neutral governance the way A2A does under the Linux Foundation.

ACP is run by a Technical Steering Committee with up to seven seats, one per organization, currently filled by OpenAI, Stripe, and Meta. OpenAI and Stripe hold permanent status as Founding Maintainers, appoint new TSC members, and retain a limited veto over TSC decisions, reserved for cases that would compromise the protocol's neutrality, security, or coherence. The project's own governance document states the intention to eventually hand control to a neutral foundation, similar to the Linux Foundation or OpenJS, but says that transition depends on broader adoption and a more mature contributor base first. That has not happened yet.

In practice, that means ACP today is best described as an open source project with dual-vendor stewardship rather than a neutral standard. Anyone can build against the spec and the Apache license protects that. But the direction of the protocol, and the makeup of who gets a formal vote on it, currently runs through OpenAI, Stripe, and whichever additional organizations they choose to seat.

How ACP compares to other agentic payment efforts

ACP is not the only initiative aimed at agent-driven commerce, and the names are similar enough to cause confusion.

Google announced its own Universal Commerce Protocol (UCP) in January 2026, an open source standard aimed at the same interoperability problem between AI agents and retail systems. It is a separate project from ACP, not a competing implementation of the same spec, and the two have not announced any formal alignment.

Alibaba's ecosystem runs something with an almost identical name, the Agentic Commerce Trust Protocol, unveiled in January 2025 and used to connect Alipay's AI Pay processing service with Qwen and Taobao's instant commerce features in China. It solves a similar problem for a different market and is unrelated to the OpenAI/Stripe project despite the overlapping name.

Mastercard's involvement is narrower than it might look from the SERP. Mastercard launched its own Mastercard Agent Suite in January 2026, a set of tools for banks and retailers to build agentic AI workflows, which is a separate initiative from ACP, not a joint venture with OpenAI or Stripe. Where Mastercard shows up inside ACP itself is only as one of the card networks a payment handler can accept, alongside Visa and American Express, the same role it plays in any card-based checkout.

FAQ

What does ACP stand for? Agentic Commerce Protocol. It is also referred to by its GitHub org name, agentic-commerce-protocol.

Who created ACP? OpenAI and Stripe, announced together on September 29, 2025, with the Agentic Commerce Protocol open-sourced the same day.

Is ACP an open standard or an OpenAI/Stripe product? Both, depending on which part you mean. The specification is Apache 2.0 licensed and open to outside contribution. Governance is not neutral yet, OpenAI and Stripe hold Founding Maintainer status with veto authority, and the current Technical Steering Committee seats are OpenAI, Stripe, and Meta. The project states a neutral foundation is the long-term goal, not the current state.

Is ChatGPT's Instant Checkout still live? Largely no, in its original native-checkout form. By spring 2026, OpenAI and its launch partners had shifted toward a model where ChatGPT surfaces products and the buyer completes payment on the merchant's own site or app, after Walmart reported conversion rates roughly three times lower for purchases completed natively inside ChatGPT.

Which merchants actually use ACP today? Etsy was the only merchant live at ACP's launch. Shopify was announced with over a million merchants "coming soon," including Glossier, SKIMS, Spanx, and Vuori, but reporting from March 2026 put the number of Shopify merchants that ever went live inside Instant Checkout at around 30. Walmart listed roughly 200,000 products before pivoting to its own Sparky assistant. Treat any specific merchant's live-integration claim as something to verify rather than something to assume from the launch announcement.

Does Mastercard have its own version of ACP? No. Mastercard's Agent Suite, launched January 2026, is a separate initiative for banks and retailers building agentic AI tools. Inside ACP, Mastercard appears only as an accepted card network within a payment handler's configuration, the same role Visa and American Express play.

How does ACP relate to Google's Universal Commerce Protocol? They are separate, unaffiliated projects solving a similar interoperability problem. Google announced UCP in January 2026. No formal alignment between the two has been announced.

What does a merchant actually have to build to support ACP? A REST API implementing checkout session creation, update, retrieval, completion, and cancellation, plus support for at least one payment handler for credential delegation. The merchant keeps its existing commerce backend, payment processor, and fulfillment systems, ACP only standardizes the interface an agent uses to talk to them.

Where this fits if you are building agent commerce

ACP's specification and checkout API are real, actively maintained, and worth building against if you want a merchant to be reachable by agents without one-off integration work per platform. What is not settled is whether native, in-chat checkout is actually where agentic commerce lands, given that the retailers who tried it first moved away from it within months. If you are scoping an agent build that touches payments, plan for both patterns, an ACP-compliant checkout API and a clean handoff back to your own site, and verify any specific platform or merchant integration claim against its current state rather than its launch-day press release.

AY Automate builds agent systems on Claude Code, the Claude Agent SDK, and the commerce and payment protocols merchants are actually shipping against. If you're scoping where agent-driven checkout fits your stack, or whether a redirect flow beats a native one for your catalog, book a consultation and we'll walk through the tradeoffs against your actual conversion data.