Fact check, August 27, 2026. AP2 did not itself "join" FIDO. Google contributed AP2, while Mastercard and Google contributed their Verifiable Intent work, for further development within the FIDO Alliance.
AP2 and Verifiable Intent were contributed to FIDO (May 2026)
On May 26, 2026, the FIDO Alliance said that Google's Agent Payments Protocol and Mastercard's Verifiable Intent, co-developed with Google, had been contributed to the Alliance. The Payments Technical Working Group is the forum for the next standardization work. This is a contribution to an industry process, not proof that every payment provider already supports AP2.
- AP2 is built on signed mandates: a Checkout Mandate (what the user wants to buy, and under what conditions) and a Payment Mandate (amount, instrument, timing), each moving from an Open to a Closed state depending on whether the cart is in progress or finalized. This covers both human-present and autonomous transactions.
- Verifiable Intent turns that authorization into portable cryptographic evidence verifiable by issuers, networks and merchants, as a natural complement to AP2.
In the same period, Visa announced planned integration of Visa Intelligent Commerce capabilities with OpenAI, while Mastercard launched Agent Pay for Machines for software-to-software payments. These announcements concern their own products and do not establish universal AP2 availability. Details and primary sources are listed in our June 2026 agentic-payments briefing.
Source: FIDO Alliance, "Building the Trust Layer for Agentic Payments with AP2 and Verifiable Intent", May 26, 2026.
What is the Agent Payments Protocol (AP2)?
AP2 v0.2 is an open protocol for securing payments performed by agents. It operates as a security feature inside a commerce protocol. Catalog, checkout updates and the APIs used by participants remain outside AP2's scope. UCP can negotiate AP2 through the optional dev.ucp.shopping.ap2_mandate checkout extension.
The protocol defines five roles: Shopping Agent, Credential Provider, Merchant, Merchant Payment Processor and Trusted Surface. One organization can perform more than one role, but it assumes every responsibility attached to those roles.
How AP2 works technically
1. Checkout Mandate
The Shopping Agent assembles the mandate content and a Trusted Surface obtains the required signature. A closed Checkout Mandate contains a merchant-signed checkout JWT and gives the Merchant cryptographic proof that the agent is authorized to complete that checkout.
2. Payment Mandate
The Payment Mandate authorizes payment for a particular checkout. It is bound to the signed checkout through a cryptographic hash and is verified by the Credential Provider, payment network where applicable, and Merchant Payment Processor.
3. Receipts
The Merchant returns a signed Checkout Receipt after accepting or rejecting the Checkout Mandate. The Merchant Payment Processor returns a signed Payment Receipt after processing the Payment Mandate. These artifacts can be validated later as evidence.
Human-present and autonomous flows
In the direct flow, the user approves closed Checkout and Payment Mandates for a finalized checkout. In the autonomous flow, the user first signs open mandates containing constraints; the agent later signs closed mandates linked to those open mandates. A participant can return unresolved_constraint and bring the user back into the loop.
AP2 for merchants: what to implement
A merchant implementing AP2 must:
- generate the merchant-signed checkout JWT;
- verify the Checkout Mandate or delegate that verification explicitly;
- complete payment with a credential scoped to the checkout and mandate binding;
- return a signed Checkout Receipt and process receipt errors deterministically.
AP2 does not define a universal Stripe, Adyen or Shopify activation screen. Confirm provider availability and setup in the provider's current product documentation.