AP2 (Agent Payments Protocol)

Once an agent can spend your money, the hard question is trust: how does a merchant or a card network know the agent is acting within what you actually authorized, and not hallucinating a $4,000 order? AP2 answers that with signed mandates rather than by trusting the agent's word.

AP2 represents a single agent purchase as up to three mandates. The Intent Mandate captures scope and limits — "running shoes, size 10, under $150, white or grey, ship to my saved address" — signed by the user in their AP2 client. The Cart Mandate is the specific items and final price the agent assembled, approved by the user (for a real-time purchase) so there is a tamper-evident record of exactly what was agreed. The Payment Mandate is what the merchant or payment network is authorized to charge. Each mandate is carried as a verifiable credential — a signed JSON object any party in the chain can check — so authorization travels with the transaction instead of living only in the agent's memory.

AP2 was announced by Google in September 2025 with a large group of payment and commerce partners, and is positioned as payment-method-agnostic and composable with other agent standards: a2a-protocol for agent-to-agent messaging, a commerce layer such as ucp-universal-commerce-protocol for the shopping flow, and extensions for card networks or crypto settlement. As of 2026 it is an early, actively evolving specification with a handful of public pilots, not a settled, universally accepted rail.

How it works

The mandates chain together. The user's client signs an Intent Mandate describing what is allowed. The agent shops (often through a separate commerce protocol), builds a cart, and produces a Cart Mandate; for a human-present purchase the user signs it to confirm the exact items and amount, and for a delegated "buy it when it drops below $X" purchase the Intent Mandate itself has to be specific enough to stand in for that approval. A Payment Mandate then authorizes settlement against the user's chosen instrument. Because each step is a signed verifiable credential, the merchant, the payment network, and any intermediary can independently verify that the charge falls inside what the user authorized, and there is an auditable trail if it does not.

Example

A user tells their shopping agent: "reorder my usual coffee beans when I'm down to the last bag, up to $40 a month." The agent creates an Intent Mandate with that ceiling and a product description, signed by the user's client. Three weeks later it finds the beans at $18, builds a cart, and — because the intent was specific and pre-approved — issues a Cart Mandate and a Payment Mandate for $18 against the user's saved card. The merchant verifies all three mandates before shipping; a $60 order, or a different product, would fail that check.

How it differs

Common misconceptions

FAQ