The Agent Payments Protocol (AP2): A New Standard for Autonomous Commerce

Google has announced the Agent Payment Protocol (AP2). It is an open protocol to securely verify and transact agentic payments across various platforms. Leading technological and payment companies, such as American Express, Etsy, Mastercard, Coinbase, PayPal, Salesforce, etc., are partners in this development.

The idea of agentic payments is compelling. A user asks an agent to manage the whole purchase automatically from a product, choice, and up to payment. However, this process introduces significant security and trust gaps. How can a merchant trust an agent? Who takes responsibility in case of fraud? Is it the user, the merchant, or the LLM developer?

Together with our PixelPlex Web3 team, we’ve explored the protocol’s benefits, ways to address the challenges, and its potential to shape the future of payment systems, e-commerce, and other related domains. Feel free to plunge into our overview.

The core functionality of AP2

AP2 protocol is designed to become a secure foundation for future AI-driven payments. It is compatible with A2A (Agent2Agent) and MCP (Model Context Protocol) ecosystems. Therefore, AP2 enables agents to not just communicate (A2A) but also to transact securely on behalf of users within a shared context.

Here are the main principles of AP2:

• Openness and connectivity: AP2 is an open-source extension for A2A and MCP. It engages anyone to innovate.
• User control and privacy: The role-based architecture of the protocol allows sharing sensitive information only with the user’s permission.
• Verifiable intent: Transactions happen only when all the involved participants agree, i.e., a cryptographically signed proof of intent. It prevents unapproved, inferred actions.
• Clear accountability: A clear non-reputable audit trail of any transaction allows for transparent processing and easy dispute resolution.
• Future-proof: The protocol allows for card payments, as well as real-time bank transfers, and digital currencies.

Therefore, these core principles address the problem of today’s payment systems, which is determining who clicks the “buy” button and becomes accountable for the purchase. The protocol solves the challenges of the three As (Authorization, Authenticity, and Accountability). Here’s how:

How does it work?

AP2 creates a common framework to make AI-driven transactions secure, traceable, and compatible across different platforms. Let’s look at the core technical components.

Mandates (Proof of Permission)

A mandate is a digital, sealed record of what a user has agreed to. It acts as proof for every transaction. AP2 uses three kinds:

• Cart mandate (human-present): The user approves a specific cart, and the store confirms the order details.
• Intent mandate (human-not-present): The user gives advance permission for an AI to make purchases within set rules, like a budget or product type.
• Payment mandate: A short, secure note taken from the above mandates that tells the bank whether a person or an AI approved the payment, without slowing things down.

All mandates are built on a common web standard, making them secure, easy to move between systems, and preventing tampering. These mandates serve as provable user consent directly in the payment process. Therefore, stores receive strong evidence for disputes, and banks receive clear signals of users’ approval of the transaction.

Roles and responsibilities

AP2 defines clear jobs for everyone involved to make sure private data is handled safely:

• User: The person who wants to buy something.
• Agent: The AI that does the shopping.
• Credential provider: A secure service that holds payment details and handles logins.
• Merchant/Processor: The store (or its payment system) that receives the order and gets paid.
• Issuer/Network: The bank or card company that approves the transaction, using its normal fraud checks plus the extra context from the mandate.

This separation of duties keeps sensitive payment data with the secure credential providers, reduces risk for stores and AI agents, and ensures everyone can be held accountable.

User workflows

The protocol supports two main scenarios:

1. Real-time purchases (human present): In this mode, you instruct your AI assistant to find, for example, a pair of hiking boots for you. The assistant records your goal in an intent mandate. When the pair is selected, you should approve it. Your confirmation creates a signed cart mandate, which finalizes the specific products and cost.
2. Delegated tasks (human not present): Here, you ask your assistant to purchase, for example, plane tickets at the best price as soon as they become available. By signing a detailed intent mandate with set rules in advance, the assistant may generate and submit a cart mandate automatically once the criteria are fulfilled without your physical approval. The set rules might be max price, time window, specific product features, etc. The agent cannot deviate from these pre-defined constraints.

Fitting AP2 into your existing payments infrastructure

AP2 isn’t a replacement for your legacy payment processors, such as Adyen, Worldpay, or PayPal. It is a secure “pre-authorization” and context layer that feeds into existing rails (card networks, bank transfers, etc.). Besides, AP2 is payment-agnostic, as it supports everything from credit/debit cards to stablecoins and real-time bank transfers. The protocol supplements crypto payment solutions development and allows for additional automation that increases customer satisfaction and adds competitive power.

Besides, the AP2 protocol opens new possibilities in digital commerce. For example, it enables smarter shopping where agents automatically purchase hard-to-find items of rare colors or fabrics. Merchant agents can generate personalized offers. For example, if a shopper agent needs a product urgently, the merchant agent offers custom, time-sensitive deals. AP2 protocols also allow for handling coordinated tasks. Just imagine an agent simultaneously booking a flight, hotel, and a car for a budget-friendly family trip.

Here are the business domains that can benefit from implementing the AP2 protocol.

Error handling and transaction integrity

Errors and disputes occur with any new tool and solution. However, the protocol creates an immutable record that serves as the foundation for resolution. Whether an error appeared due to the agent’s, merchant’s, or user’s misunderstanding, it is possible to resolve the dispute and offer a solution transparently.

This table contains possible scenarios that might occur with AP2, their causes, and ways to mitigate them.

Implementation complexity and cost for businesses

Implementing AP2 is like adding a new, highly secure digital notary service to your checkout process. The notary (AP2) verifies the identity and authority of the buyer’s agent and certifies the order details. Once certified, the transaction is passed to your existing delivery service (your payment processor, like Stripe or Worldpay) to handle the actual movement of money. Therefore, you don’t need to rip and replace your current payment systems. AP2 complements them by adding the critical trust context they currently lack for autonomous transactions.

The integration with existing systems happens through APIs. Therefore, the costs would include:

• Developer resources: Engineering teams need to learn the AP2 specification and integrate the mandate-handling logic into the e-commerce platform, ERP, or procurement systems.
• API development: Building the internal endpoints to receive, validate, and process mandates from customer agents.
• Testing & QA: Rigorously testing the new autonomous transaction flows alongside traditional human-checkout flows.
• Partner coordination: Working with your payment processor to ensure they can receive and utilize the mandate data you forward.

What are the benefits?

The investment allows for capturing new revenue streams, previously hard to reach, and reducing operational costs and fraud risks:

• Merchants address the “missed sale” problem. AP2 enables them to capture sales that would otherwise be lost to “out-of-stock” or “price sensitivity” by allowing agents to monitor and purchase automatically when conditions are met.
• Users who delegate purchasing power to their agents are considered “high-intent” customers. They are likely to close deals, which increases conversion.
• Creating personalized and dynamic offers allows for both a convenient shopping experience for users and a high-value sale for merchants.
• The non-repudiable audit trail provided by mandates makes it nearly impossible for a user to falsely claim they didn’t authorize a transaction that their agent performed within its mandate. This directly reduces costly chargebacks and dispute resolution overhead.
• The cryptographic verification of intent makes it difficult for bad actors to initiate fraudulent transactions through impersonation or bots.
• In case of errors, clear accountability reduces the time and cost to resolve issues.

Let’s compare the AP2 protocol to its alternative solution, smart contract development.

Use case: a two-step verification for agent-driven transactions

AP2 is brilliant for establishing authorization and intent, but it’s not designed to be a full-spectrum threat intelligence system. Integration with tools like W3A fills that gap. The AP2 protocol prevents authorized but mistaken transactions (e.g., an agent buying the wrong product from a legitimate merchant), while the Web3 Antivirus additionally prevents malicious transactions (e.g., an agent interacting with a fraudulent DeFi protocol that drains the wallet). Such a combination provides a holistic protection of users’ funds. Here’s how it works:

1. An agent prepares a transaction. The user’s agent, operating under a valid AP2 mandate, prepares the final transaction payload. This includes the target smart contract address, function call, amount of cryptocurrency, etc.
2. Intercept and query. Before the agent signs and broadcasts the final transaction, your system intercepts the payload and sends it to the Web3 Antivirus API for a real-time risk assessment.
3. Risk scoring and response. The Web3 Antivirus engine analyzes the transaction against its threat intelligence database (known scams, rug pulls, malicious code, anomalous patterns). After the analysis, it returns a risk score (e.g., Low, Medium, High) and a detailed report (e.g., “Contract is a known honeypot,” “Function signature matches a drainer pattern”).
4. Enforcement point: Your system (the wallet or agent platform) receives the risk score and enforces a policy. In case of low risk, the transaction is approved, signed with the user’s private key, and broadcast to the network. The AP2 flow completes. If the risk is high, the transaction is blocked. The user and their agent are immediately alerted with the reason and the AP2 flow is halted, preventing the loss of funds.

Business value

This combination is a significant competitive advantage, especially for businesses operating in the Web3 space.

• Exchanges and crypto wallet development companies can offer the integration of AP2 with W3A as a premium feature for users who delegate trading or management to agents, significantly reducing their risk exposure.
• Businesses that offer DeFi development services can ensure every action is screened against real-time threat data, preventing catastrophic losses.
• Insurance providers can underwrite policies for agent-driven transactions at a lower premium if they are protected by this dual-layer security model, as the risk of loss is dramatically reduced.

This integration allows AI agents to make sure the money is not sent to a scammer. It analyzes the transaction’s destination (smart contract, wallet address) for known threats, malicious code, or deceptive patterns.

Wrapping up: preparing for an agentic future

The future of AP2 hinges on open collaboration. Google is already building a coalition with over sixty companies to develop the protocol out in the open on GitHub. The goal is to create a universal standard that prevents a messy, fragmented system where every company uses a different, incompatible method. This open approach allows everyone to build on the same reliable foundation.

This is a classic cycle of technological progress: a breakthrough like AI breaks the old rules, necessitating a new foundation to harness its potential safely. AP2 is a direct bet on a future where AI handles routine purchases, and its success depends entirely on establishing trust. At PixelPlex, we actively help build this future securely. We believe that complementing AP2’s trust framework with the proactive threat detection of a Web3 Antivirus is not only feasible but essential. This combination creates a holistic strategy, making autonomous, agent-driven transactions secure enough for widespread enterprise and consumer adoption.