The Agentic Commerce Protocol, explained for merchants

Who built ACP

The Agentic Commerce Protocol is maintained jointly by OpenAI, Stripe, and Meta — all three are listed as governance partners in the project's MAINTAINERS file at github.com/agentic-commerce-protocol. The license is Apache 2.0: free to implement, redistribute, and fork. The canonical specification site is agenticcommerce.dev.

The current stable spec version is 2026-01-30. A 2026-04-17 version is published as next, adding OpenRPC, cart, feeds, and webhook coverage on top of the baseline. A merchant building today targets the stable version and follows the next version's changelog for migration planning.

Why ACP exists

ACP exists so an AI agent can complete a purchase end-to-end with the buyer never landing on the merchant's storefront. That changes what matters commercially. Hero photography, lifestyle copy, and conversion-rate optimization do not move a buyer-never-lands flow. What moves it: feed completeness so the agent finds the right SKU, endpoint reliability so the checkout call succeeds, and clean structured data so the agent represents the product accurately. The discovery half of that problem — getting the SKU into the answer in the first place — is the subject of the product AI visibility pillar; ACP picks up at the moment the buyer says yes.

What a merchant exposes

An ACP-ready merchant surface has four pieces:

1. A discovery file at /.well-known/acp.json — proposed, still RFC-stage rather than promoted into the stable spec. It advertises endpoint base URLs, supported API versions, and capability flags.
2. Five checkout endpoints, each requiring Authorization: Bearer, Content-Type: application/json, and an API-Version header.
3. Capability negotiation — supported currencies, shipping regions, line-item types. Part of the 2026-04-17 RFC surface; in flux.
4. Order webhooks — the merchant signals fulfillment milestones back to the agent platform.

CopyPOST /checkout_sessions               # open a session: line items, buyer, shipping
GET  /checkout_sessions/{id}          # read state and pricing
POST /checkout_sessions/{id}          # update the session
POST /checkout_sessions/{id}/complete # pay with the delegated vault token
POST /checkout_sessions/{id}/cancel   # release the session

Note what is absent: the payment instrument. Authorization happens at the PSP — Stripe is the first publicly named compatible PSP — via POST /agentic_commerce/delegate_payment. The merchant receives a vault token (vt_…) bounded by an allowance object: max_amount, currency, merchant_id, expires_at, reason: "one_time". The merchant never sees the buyer's card.

End-to-end purchase walkthrough

The verified sequence, drawn from the 2026-01-30 spec:

1. Discovery. The agent fetches /.well-known/acp.json (proposed) for base URL and capabilities.
2. Open a session. POST /checkout_sessions with line items, buyer email, shipping address. The merchant returns session ID, pricing breakdown, tax, shipping options, and a lifecycle state.
3. Delegate payment. The agent calls the PSP's delegate-payment endpoint with the total and allowance constraints; the PSP returns the vault token.
4. Complete. The agent completes the session with payment_data.instrument.credential.type = "spt" and the token. The session moves in_progress → completed.
5. Webhook. The merchant fires order-created with its own order ID; shipped and delivered milestones follow.

Lifecycle states run not_ready_for_payment → ready_for_payment → in_progress → completed (or canceled). A merchant that cannot quote a final total — say, a configured product awaiting shipping calculation — sits in not_ready_for_payment until pricing resolves.

ACP vs UCP: a fork in the road

Dimension	ACP	UCP
Maintainers	OpenAI, Stripe, Meta	Google + Shopify, Etsy, Wayfair, Target, Walmart, ~20 partners
Consumer surface	ChatGPT Instant Checkout	Google AI Mode, Gemini
License	Apache 2.0	Open spec; terms on developers.google.com
Current spec	2026-01-30 stable	2026-04-08 (2026-01-23 supported)
Discovery	/.well-known/acp.json — proposed, RFC-stage	/.well-known/ucp — required
Shopify stance	Not officially backed	Launch partner; Agentic Storefronts wraps it

The full Google-side treatment is in the UCP guide. The shared lesson: both protocols presume a catalog an agent can already read — which is ACO groundwork, not protocol work.

Implementation reality for Shopify

Shopify does not officially back ACP; Shopify backs UCP and ships its own Agentic Storefronts integration. A Shopify brand wanting ACP exposure today would need custom endpoint infrastructure in front of the store plus a Stripe relationship for delegated payment — justifiable for large multi-channel merchants, hard to justify for a $5M–$200M brand while the consumer volume is still pilot-stage. The pragmatic posture: ship the agent-readable groundwork now, let the platform carry the protocol later. The agent-readability score measures exactly that groundwork per SKU, and the free readiness grader checks any PDP.

Where the spec is honest about being early

• Discovery is RFC-stage. /.well-known/acp.json has not been promoted into stable; agents may rely on out-of-band registration instead.
• One named PSP. Stripe is the only publicly named first compatible PSP; the delegated-payment surface for other processors is still forming.
• Pilot merchant set. Instant Checkout runs with a limited merchant list as of mid-2026; eligibility is gated, not self-serve.
• Feeds and carts are "next." The richer 2026-04-17 surface — feeds, cart objects, fuller webhooks — is published but not stable.

Anyone presenting ACP as mainstream consumer behavior in mid-2026 is ahead of the published facts.

What to do about it

1. Treat ACP as a destination, not a project: no custom endpoints until volume justifies them.
2. Ship the shared groundwork — schema, availability, crawler access, policies — per the schema guide and the ACO checklist.
3. Win the discovery layer first: an agent cannot buy a SKU it never recommends. How to rank products in ChatGPT is the relevant playbook.
4. Track per-SKU agent-readability alongside citations — both scores live in the eCommerce Insights ledger.