Agentic Commerce Protocol (ACP)

The Agentic Commerce Protocol (ACP) is an open standard for agentic commerce — the rules and data structures that let AI agents complete purchases on behalf of users without redirecting them to a merchant's website. Co-developed by OpenAI and Stripe and released in September 2025, ACP is Apache 2.0 licensed and currently powers Instant Checkout in ChatGPT, giving participating merchants programmatic distribution to ChatGPT's hundreds of millions of users.

The architectural shift: who owns the checkout

The most distinctive thing about ACP is who owns the checkout interface. In a traditional ecommerce flow, the seller owns the entire experience: the product page, the cart UI, the checkout form, the payment fields, and the order confirmation. The seller's brand surrounds every step.

In an ACP flow, that responsibility splits:

• The AI agent renders the user interface. The cart, the totals, the shipping selector, the payment input — all displayed inside ChatGPT (or any other ACP-compatible agent), not on the seller's site.
• The seller handles the underlying cart logic, line item management, tax and shipping calculation, payment processing, and order fulfillment. Their backend systems still own the source of truth.

The customer never visits the seller's site to complete the purchase. They see a checkout surface inside ChatGPT, the agent and seller exchange data over the protocol, payment processes, and the order shows up in the seller's existing system as if it were a normal order.

The four checkout endpoints

An ACP-compatible seller exposes a RESTful HTTP interface (or an MCP server) with four endpoints:

• Create checkout: the agent initiates a checkout session with line items and customer details; the seller responds with cart data, supported payment methods, fulfillment options, and totals.
• Update checkout: as the customer makes selections inside the agent UI (quantity changes, shipping address, fulfillment options), the agent and seller exchange updates.
• Complete checkout: the agent passes a payment token; the seller processes payment and responds with order confirmation details.
• Cancel checkout: the agent notifies the seller that the customer has exited, releasing inventory holds.

All requests use HTTPS with Bearer authentication; webhook events sent from seller to agent (for order status updates) are HMAC-signed.

SharedPaymentToken (SPT): the payment layer

ACP's payment model relies on the SharedPaymentToken — a token issued by the user's payment provider (Stripe, primarily) that:

• Is scoped to a specific seller, amount, and time window.
• Is single-use or reusable depending on configuration.
• Is revocable at any time by the user.
• Doesn't expose underlying credentials to the seller or the agent.
• Is designed to be compatible with card networks' emerging agentic-token standards.

For sellers already using Stripe, enabling SPT support is reportedly a single-line code change in existing PaymentIntent flows. For sellers on other payment providers, ACP's payment-handler model allows custom token handling — though Stripe-issued SPTs are the dominant pattern at launch.

ACP vs. UCP

ACP and UCP are parallel commerce protocols at the same layer, launched four months apart by competing platforms:

• ACP (OpenAI + Stripe, September 2025): launch surface ChatGPT Instant Checkout. Stripe payment-token model. Apache 2.0 licensed. Adopted by Shopify, Etsy, and others on the merchant side; Microsoft Copilot, Anthropic, Perplexity, Vercel, and others on the agent/platform side.
• UCP (Google + Shopify, January 2026): launch surface Google AI Mode in Search and Gemini. Compatible with Google's Agent Payments Protocol (AP2), MCP, and A2A. Endorsed by 20+ retailers.

The two protocols overlap in scope (both define checkout, both target programmatic agentic transactions, both keep the merchant as merchant of record). They differ in lead sponsor, payment-token model, and launch surface. Industry consolidation isn't expected near-term — merchants will likely need to support both for full agentic-commerce reach.

What this means for Shopify merchants

Shopify is in both camps. It was an early ACP adopter on the merchant side, then co-developed UCP with Google. The practical implication for Shopify merchants is that both protocols are platform-managed:

• ACP coverage via Shopify's existing ChatGPT integration. Merchants get distribution to ChatGPT's audience without writing protocol-level code.
• UCP coverage via Shopify's Agentic plan and Agentic Storefronts admin layer.
• Single source of truth. Shopify's central admin manages both protocol integrations from one place — orders, inventory, and customer records remain in the merchant's existing Shopify backend regardless of which agent surface generated the order.

The merchant decision is rarely "which protocol" — it's how aggressively to participate in agentic surfaces overall, and how to balance agentic distribution against owned-channel investment.

The strategic trade-off merchants should weigh

ACP gives merchants distribution to ChatGPT's audience. The price is checkout-experience control. The agent renders the cart, the totals, the shipping selector. The merchant's brand surface during the most important moment of the transaction is reduced to product images, descriptions, and price — without the storefront design, the upsells, the bundle suggestions, the post-purchase email collection, or the cart-abandonment recovery flows the merchant has built over years.

For some merchants — commodity goods, low-margin items, products bought on impulse — that trade-off is favorable. For brand-led merchants whose differentiation lives in the experience, it warrants more careful consideration.

Common ACP misconceptions

• "ACP is owned by OpenAI." Open standard, Apache 2.0 licensed, jointly governed by OpenAI and Stripe as Founding Maintainers, with a published community-governance roadmap. The protocol is vendor-neutral; ChatGPT is the most prominent surface implementing it, not the only one.
• "ACP is only for Stripe customers." Stripe is the most-promoted payment handler, but ACP supports custom payment handlers for sellers using other processors. Tooling for non-Stripe stacks is less mature, but the spec doesn't lock to Stripe.
• "If I use ACP, I lose ownership of my customers." The merchant remains merchant of record and retains ownership of order data and the post-purchase relationship. What the merchant loses is the storefront experience for ACP-originated purchases — the customer never visits the site, so direct-traffic data and brand-surface impressions for those orders are reduced.
• "ACP and UCP are the same thing." Different protocols, different lead sponsors, different launch surfaces. Both exist, both are likely to persist, and merchants will probably need to support both.

Enabling either protocol is a smaller lift than getting the underlying product data ready for it: the four checkout endpoints and SharedPaymentToken handling are largely Shopify’s problem to solve, but an agent can only complete a good checkout if the product data behind it — accurate variants, inventory, shipping rules — is exposed cleanly through Storefront APIs and checkout configuration. That data readiness work overlaps heavily with the broader question of preparing a catalog for AI-driven discovery generally, so most merchants end up doing both at once rather than treating ACP as an isolated integration.

ACP is one piece of a larger shift rather than an isolated integration decision, and merchants deciding how aggressively to build for it tend to get more out of that decision once they’ve placed it against how AI is already being used across ecommerce, from product recommendations to demand forecasting and the move toward agentic commerce.