What is the Agentic Commerce Protocol? ACP explained for ecommerce.

Who built ACP

The Agentic Commerce Protocol is maintained jointly by OpenAI, Stripe, and Meta. The MAINTAINERS.md file at github.com/agentic-commerce-protocol/agentic-commerce-protocol lists all three as governance partners. The license is Apache 2.0, which means the protocol is free to implement, redistribute, and fork. The canonical specification site is agenticcommerce.dev.

Current stable spec version is 2026-01-30. The 2026-04-17 version is published as the next release; it adds OpenRPC, cart, feeds, and webhook coverage on top of the 2026-01-30 baseline. A merchant building today should target the 2026-01-30 stable and follow the 2026-04-17 changelog for migration planning.

Why ACP exists

ACP exists so an AI agent can complete a purchase end-to-end without the buyer ever landing on the merchant's storefront. The headline use case is ChatGPT Instant Checkout: a buyer asks ChatGPT for a product, says "buy it" inside the conversation, and the agent runs the transaction. The protocol defines the contract between the agent, the merchant, and the payment service provider so that "buy it" reliably resolves to a fulfilled order.

That changes what matters for the merchant. Hero photography, lifestyle copy, and storefront conversion-rate optimization do not move the needle in a buyer-never-lands flow. What moves the needle is feed completeness so the agent finds the right SKU, endpoint reliability so the checkout call succeeds, and clean structured data so the agent represents the product accurately to the buyer.

The four pieces a merchant exposes

An ACP-ready merchant exposes four primitives:

1. A proposed discovery file at /.well-known/acp.json. This is RFC-stage, not yet promoted into the stable spec. Hedge accordingly. It is intended to advertise endpoint base URLs, supported API versions, and capability flags.
2. Five checkout endpoints. The full set: POST /checkout_sessions, GET /checkout_sessions/{id}, POST /checkout_sessions/{id}, POST /checkout_sessions/{id}/complete, POST /checkout_sessions/{id}/cancel. Required headers on each: Authorization: Bearer, Content-Type: application/json, API-Version: YYYY-MM-DD.
3. Capability negotiation. Surfaces what the merchant supports — currencies, shipping regions, line-item types, etc. Discovery is in flux; capability flags are part of the 2026-04-17 next version's RFC.
4. Webhook orders. The merchant signals back to the agent platform when the order moves through fulfillment milestones. The 2026-04-17 next adds richer webhook event coverage.

Note what is not in the merchant's surface: the payment instrument. Payment authorization happens at Stripe's POST /agentic_commerce/delegate_payment endpoint, which is PSP-side rather than merchant-side. The merchant never sees the buyer's underlying card; it sees a vault token (vt_...) bounded by an allowance object (max_amount, currency, merchant_id, expires_at, reason: "one_time"). See the vault token glossary entry for the SPT vs vault-token distinction.

End-to-end purchase walkthrough

The verified sequence, drawn directly from the 2026-01-30 spec:

1. Discovery. The agent fetches /.well-known/acp.json (proposed) to learn the merchant's base URL and capabilities.
2. Open a session. POST /checkout_sessions with line items, buyer email, and shipping address. The merchant returns a session ID, pricing breakdown, tax, shipping options, and a lifecycle state of not_ready_for_payment or ready_for_payment.
3. PSP delegate payment. The agent calls POST /agentic_commerce/delegate_payment on Stripe with the order total and allowance constraints. Stripe returns the vault token.
4. Complete. The agent calls POST /checkout_sessions/{id}/complete with payment_data.instrument.credential.type = "spt" and the vault token value. The session transitions to in_progress then completed.
5. Webhook. The merchant fires its order-created webhook to the agent platform with the merchant's order_id. Downstream fulfillment milestones (shipped, delivered) follow as the order ships.

The lifecycle states run not_ready_for_payment → ready_for_payment → in_progress → completed (or canceled). A merchant that cannot quote a final total — for example, a configured product still waiting on shipping calculation — sits in not_ready_for_payment until pricing resolves.

ACP vs UCP: a fork in the road for Shopify brands

Two open protocols, two stacks, two adoption stories.

For a Shopify brand, the practical takeaway is that Shopify backs UCP. ACP is a viable surface — and it owns the ChatGPT reach that the Google stack does not — but the Shopify-blessed route to ChatGPT is via the OpenAI relationship wrapped inside Shopify Agentic Storefronts, not via merchant-implemented ACP.

What ChatGPT Instant Checkout means commercially

Instant Checkout is the headline reason a merchant cares about ACP at all. A buyer in ChatGPT asks for a product, says "buy it," and the transaction completes without the buyer leaving the chat surface. The merchant gets the order; ChatGPT gets the loyalty signal.

Commercial implications worth flagging:

• Channel attribution becomes opaque. The buyer never lands on the merchant's storefront, so existing UTM-based attribution does not fire. Attribution flows through whatever metadata ChatGPT passes in the checkout session payload.
• Brand surface is the agent's, not yours. A buyer's lasting impression is shaped by how ChatGPT recommends the product, not by the storefront's design or messaging. Investment in PDP copy and structured data pays off here, but not the same investments that pay off in DTC.
• The agent picks the winner. ChatGPT cites a small number of products per query. If the merchant's SKU is not the one cited, the slot goes to a competitor or a review site. SKU-level visibility tracking — what eCommerce Insights does — is how a brand sees which SKUs are showing up and which are not. See SKU-level tracking.

Implementation effort for Shopify

There are three paths a Shopify brand can take to participate in ChatGPT Instant Checkout. None of them are trivial, but they differ in cost and risk.

Path 1: Wait for or enable Shopify Agentic Storefronts

This is the cleanest path for most brands. Shopify's channel wraps both the OpenAI relationship and the protocol-level work, so the merchant's responsibility narrows to feed opt-in, catalog hygiene, and fulfillment. Eligibility, tier requirements, and the exact app name are not stated verbatim on Shopify's own /ucp page as of 2026-06-03, so treat any tier-eligibility claims as unverified. See how to make my Shopify store agent-ready for the operational checklist.

Path 2: Install a third-party ACP app

The agenticcommerce.cloud listing on the Shopify App Store offers ACP integration. It is a third-party integrator and not an OpenAI/Stripe partner as of 2026-06-03. For a brand that needs ChatGPT Instant Checkout sooner than Shopify Agentic Storefronts ships in the brand's tier, this is the fastest route — but the brand inherits the integrator's roadmap risk, not Shopify's.

Path 3: Custom backend

Stand up the five endpoints, integrate Stripe's Delegate Payment, ship the proposed discovery file, and wire webhooks. For a typical mid-market Shopify team, this is six to twelve weeks of backend work, plus ongoing maintenance as the spec evolves. The 2026-04-17 next version is already on the horizon. Reasonable for a brand with a senior backend team and a strong commercial case; overkill for most.

Where the spec is honest about being early

The protocol is shipping, but the ecosystem around it is small. As of 2026-06-03:

• The discovery file is RFC-stage. The proposed /.well-known/acp.json mechanism is not yet promoted into the stable spec. Building against it means building against a moving target.
• Only Stripe is publicly named as a compatible PSP. The 2026-01-30 spec calls Stripe the "first compatible PSP with Shared Payment Token." Adyen and Braintree appear in the payment_handlers RFC as example PSP values but not as launch partners.
• Only Cartsy is named as a live merchant demo on agenticcommerce.dev. That is a deliberately small launch surface, not a reflection of the protocol's quality — but it means a merchant going first does not have many peer implementations to look at.

These caveats are not blockers. They are the reasons a Shopify brand evaluating ACP today should probably route through Shopify Agentic Storefronts or wait, rather than building merchant-side ACP directly.

Two protocols, two stacks, one buyer. The merchant's job is making sure the SKU is the one cited, no matter which agent does the citing.

What to do this week

1. Run the Agentic Readiness Grader on your storefront. It checks for /.well-known/ucp and /.well-known/acp.json presence, robots.txt admittance for the AI crawlers, and Product JSON-LD completeness.
2. Read the Universal Commerce Protocol guide next. UCP is more relevant for most Shopify brands and the two protocols' implementation work overlaps.
3. If you're considering custom ACP work, read the spec at github.com/agentic-commerce-protocol/agentic-commerce-protocol and review the 2026-04-17 next version changelog before committing engineering time.

Frequently asked questions

Related

Related glossary

• ACP (Agentic Commerce Protocol)
• Vault token vs Shared Payment Token (SPT)
• Shopify Agentic Storefronts
• UCP (Universal Commerce Protocol)
• ChatGPT platform tracking
• Agentic commerce solution overview