AP2: the protocol that authorizes an agent to pay.

A short definition

AP2 (Agent Payments Protocol) is an open protocol that standardizes how a payment triggered by an agent is authorized. Instead of sharing a card number, the agent presents a cryptographically signed proof of authorization. AP2 is the "authorization" building block of the agentic payment layer. Established

The three mandates

AP2 breaks consent into three signed proofs that form an auditable chain:

1. Intent mandate: what the user wants to accomplish (e.g. re-buy a product under a certain price).
2. Cart mandate: the exact items, price and terms the user commits to.
3. Payment mandate: the final settlement authorization.

This separation makes it possible to prove, after the fact, who authorized what and within which limits, which is the hard part of any delegated payment. Established

Governance and adoption

Initiated by Google in September 2025, AP2 had its governance handed to the FIDO Alliance and now claims 120+ partners, including PayPal and its PYUSD stablecoin. Moving under an independent standards body signals maturation of the authorization layer, even if production adoption is still emerging. Emerging

AP2 in the agentic stack

AP2 does not work alone. It combines with the other protocols in the stack:

• UCP and ACP: commerce operations (catalog, cart, checkout). See UCP vs ACP.
• A2A: agent-to-agent communication (stewarded by the Linux Foundation).
• MCP: agents' access to tools and data.
• x402: an AP2-linked extension, backed by Coinbase, for machine-to-machine stablecoin settlement.

UCP is explicitly designed to be compatible with AP2: a merchant preparing its offer for agents builds shared groundwork, whatever the authorization protocol. Established

The point where AP2 stops being optional

This is the most concrete consequence, and it is written into the UCP specification. The Checkout capability requires an order to be finalized manually by the user through a trusted UI, unless the AP2 Mandates extension is supported. Established

AP2 is therefore not a refinement of agentic payments. It is what separates an agent that prepares from an agent that executes. Without mandates, the agent assembles the cart and a human approves. With them, it can act while the buyer is away, inside limits signed in advance. The whole promise of a purchase completed with nobody at the screen rests on that single clause.

Source: UCP specification, Checkout capability, version 2026-04-08.

What it changes for a merchant

For a merchant, AP2 is mainly a trust-and-compliance guarantee: authorization is proven and traceable, and the merchant remains the seller of record. The specification further notes that the Checkout capability adds no PCI DSS compliance obligation for card payments. Established The work to do is the same as for agentic commerce: a machine-readable offer and clear governance. The audit methodology helps assess that state.

One practical point that tends to get missed: the checkout session exposes a status that drives the agent, moving through incomplete, requires_escalation, ready_for_complete, complete_in_progress, completed and canceled. The requires_escalation state is the standardized hand-off to a human. A merchant enforcing an age check, a supporting document, or manual approval above a threshold does not have to step outside the protocol to do it. Established

Frequently asked questions