AI Commerce Payments: How to Secure Purchases Made by AI Agents

When an AI agent buys something, three separate questions must each have a clear answer. Is this agent allowed to act for this person? (agent authorization). Did the person approve this purchase, or the rules it falls under? (purchase consent). May this amount be charged to this payment instrument? (payment authorization). Mixing them up is the main source of risk.

Current approaches use scoped credentials instead of raw card numbers: delegated or shared payment tokens limited by amount, merchant and expiry, network-issued agentic tokens, wallet credentials and signed mandates that record what the user authorized. The merchant remains merchant of record and handles fraud screening, refunds and disputes through its payment provider. No single payment protocol is universal yet, so build for more than one.

Delegated payment tokens. In the Agentic Commerce Protocol, the agent platform asks the merchant's payment provider for a one-time token restricted by a maximum amount and expiry, then passes it to the merchant to complete checkout. OpenAI's Delegated Payment Spec describes this, and Stripe's Shared Payment Token was the first compatible implementation (OpenAI Delegated Payment Spec).

Payment handlers. UCP lets a business declare payment handlers in its profile (for example a wallet or a processor tokenizer) and lets the platform choose one, so different credential types can be supported without changing checkout logic. Mandates. AP2 (Agent Payments Protocol), published by Google with standardization continuing in FIDO Alliance working groups, uses signed verifiable digital credentials: a checkout mandate and a payment mandate, each with an open form (constraints for autonomous execution) and a closed form (authorization for a specific checkout or amount) (AP2). UCP includes an AP2 mandates extension. Network agentic tokens. Card networks have introduced agent-specific programs, such as Mastercard Agent Pay's agentic tokens and Visa's Trusted Agent Protocol for identifying agents to merchants. Check each provider's current documentation; these programs are evolving.

Limits belong in several layers: the credential itself (maximum amount, single use, expiry, merchant and checkout binding), the agent platform's policy (per-transaction and per-period caps set by the user), and the merchant's risk rules (order value thresholds that trigger review). Mandate-based approaches let a user pre-authorize constrained autonomous purchases ('reorder printer paper under EUR 40 monthly'), but the constraints must be explicit and verifiable, not inferred from conversation.

Strong customer authentication rules still apply where they apply. Agent flows have to support step-up authentication: when the issuer or regulation requires it, the checkout returns an authentication-required state and the shopper completes the challenge, in the agent interface or on the merchant's site. ACP includes an authentication_required checkout status; UCP describes tokenization with a challenge as one payment-handler scenario. Design for the challenge path, not just the frictionless one.

Agent purchases change fraud signals: device and behavioural data from the shopper's browser are missing, and orders arrive from a small number of platforms. Do not block the channel; adjust the model. Verify the agent platform (signed requests, published keys, network agent identification), bind credentials to the checkout, check that delivery details match the account where identity is linked, and route unusual orders to review. Verification runs both ways: agent platforms and networks also verify that merchants are legitimate before passing credentials. See orders placed by AI agents and ecommerce fraud detection.

The merchant remains merchant of record, so refunds go back through the original payment provider and instrument, and disputes follow card network rules. What changes is evidence. Keep the checkout session, the totals the shopper confirmed, the agent platform identity, the credential's constraints and any mandate with the order. That record helps distinguish 'I did not authorize this' from 'the agent bought the wrong item', which are different problems with different remedies. Our guide to chargeback management covers the dispute process.

Delegated tokens, payment handlers, mandates and network tokens solve overlapping problems and come from different ecosystems. Which ones you need depends on the agent channels you sell through and your payment provider. Abstract payment completion behind your checkout API, rely on your PSP for credential handling and PCI scope, and add protocols as channels demand them. The baseline controls in ecommerce payment security still apply.

Securing agent purchases is mostly about keeping three authorizations distinct and enforced: what the agent may do, what the shopper approved and what the payment system allows. Use scoped credentials and verifiable records, keep the merchant's checkout and payment provider in control, adapt fraud controls and preserve evidence for refunds and disputes. For the checkout mechanics, see agentic checkout.