Agentic payments are transactions completed by AI agents on behalf of customers, with security and consent built in. In early 2026, Banco Santander and Mastercard completed Europe’s first live end-to-end payment executed by an AI agent, processed through Santander’s live payments infrastructure and Mastercard Agent Pay. This page tracks the main protocols and frameworks shaping agentic payments.
Mastercard
Enables secure, authenticated agentic transactions where AI agents act on behalf of consumers. Transactions flow through existing card rails; issuers, acquirers, and merchants can recognize that an agent conducted the transaction. Pilots with Santander (Europe’s first live agentic transaction) and in Australia (Commonwealth Bank, Westpac).
Focus
Card-based agentic commerce, regulated bank framework
Status: Pilot / expanding
OpenAI + Stripe
Open-source protocol (Apache 2.0) for AI-powered commerce. Powers Instant Checkout in ChatGPT so users can buy from merchants in chat. Merchants keep customer relationships, decide whether to accept orders, and fulfill with existing systems. Uses REST APIs and Stripe’s Shared Payment Token as the initial delegated payment provider.
Focus
Consumer checkout in chat, merchant control, standardized flow
Status: Live (e.g. US ChatGPT + Etsy; Shopify coming)
Protocol for agent-to-agent and multi-agent commerce, with a focus on B2B and complex negotiations. Provider-agnostic and protocol-agnostic. Primary implementation via Google ADK and Gemini.
Focus
Multi-agent commerce, B2B, flexibility
Status: Emerging
Aims to create interoperability between AI agents and merchants so agents can discover and transact with merchants in a consistent way. Part of broader agentic commerce standards collaboration.
Focus
Agent–merchant interoperability
Status: In development
Supports direct transactions and coordination between AI agents, complementing agent–merchant flows. Emphasizes clear intent, secure credentials, and verifiable agent identity.
Focus
Agent-to-agent transactions
Status: In development
Mastercard
Framework for trusted AI transactions: clear user intent, secure credentials, and verifiable agent identity. Helps protect merchants from fraud and strengthens authentication for issuers.
Focus
Trust, identity, authentication for agentic transactions
Status: Rolling out with Agent Pay
Coinbase (open protocol)
Uses the HTTP 402 Payment Required status code to enable instant stablecoin payments over HTTP. Lets APIs, microservices, and AI agents pay per request without accounts or sessions. Supports micropayments and machine-to-machine payments. Coinbase offers a hosted facilitator; protocol is Apache 2.0 with TypeScript and Go SDKs.
Focus
Stablecoin payments over HTTP, API monetization, AI agent payments
Status: Live (Base, Solana; Coinbase Payments MCP uses x402)
Tempo and Stripe
Co-authored by Tempo and Stripe and announced on 18 March 2026. An agent requests a resource from a service, API, MCP server, or any HTTP-addressable endpoint; the service responds with a payment request; the agent authorises it and the resource is delivered. Merchants on Stripe accept MPP payments through the existing PaymentIntents API, in stablecoins on the Tempo network as well as fiat via cards and buy now, pay later. Specification published at mpp.dev.
Focus
Agent-to-service payments over HTTP, API and MCP monetisation, pay-per-call
Status: Live (launched 18 March 2026; early integrations include Browserbase, PostalForm and Stripe Climate)
Cloudflare
Lets a site allow, block, or charge AI crawlers at the CDN edge, turning crawl access into a metered resource rather than a free one. Announced with GoDaddy on 7 April 2026 as an integration into GoDaddy hosting, putting per-crawler policy in front of a mass-market hosting base rather than only enterprise sites.
Focus
Crawler access policy, pay-per-crawl, fair value exchange for content
Status: Live on Cloudflare; rolling out through GoDaddy hosting
Cloudflare, with Amazon, Akamai and OpenAI
A profile of RFC 9421 HTTP Message Signatures for bot and agent authentication. An agent signs each request with an Ed25519 key, names its key directory in a Signature-Agent header, and publishes public keys at /.well-known/http-message-signatures-directory. Replaces IP-range allowlists, which cover only vendors that publish ranges, go stale between refreshes, and cannot authenticate an agent running on an end user’s own machine. An IETF working group was chartered in 2026; the architecture spec is draft-meunier-web-bot-auth-architecture.
Focus
Cryptographic agent identity, replacing IP-based bot verification
Status: Live on Cloudflare; IETF working group chartered 2026
Cloudflare and GoDaddy
Uses DNS and public key infrastructure to give AI agents consistent naming, verification and discovery across systems — an agent-era analogue of what DNS and TLS certificates did for hosts. Paired with a Signature Agent Card, which lets an agent developer publish its agent’s identity and stated purpose. Announced alongside the Cloudflare–GoDaddy partnership on 7 April 2026.
Focus
Agent naming, identity verification, discovery
Status: Announced 7 April 2026
Stripe (collaboration)
Stripe is collaborating on an open standard for agentic commerce alongside partners, with a focus on safe, interoperable AI-driven checkout and delegated payment flows.
Focus
Open standard, interoperability, safety
Status: In development
Agentic payments are transactions initiated or completed by AI agents on behalf of a user. The agent acts with the user’s consent and within defined rules, using secure credentials and identity so issuers, acquirers, and merchants can recognize and trust the agent-driven flow.
Mastercard Agent Pay is a framework that lets AI agents complete card-based payments on behalf of consumers. Transactions run over existing card rails; Santander and Mastercard completed Europe’s first live agentic transaction, and Australia has seen pilots with Commonwealth Bank and Westpac. The solution is still in pilot and not yet fully commercial.
The Agentic Commerce Protocol (ACP) is an open-source standard (Apache 2.0) developed by OpenAI and Stripe for AI-powered commerce. It powers features like Instant Checkout in ChatGPT, so users can buy from merchants inside chat. Merchants keep control of orders and fulfillment; Stripe’s Shared Payment Token is the initial delegated payment provider.
x402 is an open payment protocol that uses the HTTP 402 Payment Required status code to enable instant stablecoin payments over HTTP. It allows APIs, services, and AI agents to pay per use without accounts or sessions. Coinbase supports it via a hosted facilitator and Payments MCP; the protocol is Apache 2.0 with TypeScript and Go SDKs.
MPP is an open standard co-authored by Tempo and Stripe, announced on 18 March 2026, for agents paying services directly over HTTP. An agent requests a resource from an API, MCP server or any HTTP endpoint, the service replies with a payment request, and the resource is delivered once the agent authorises it. Like x402 it settles at the HTTP layer, but merchants can accept it through Stripe’s existing PaymentIntents API in stablecoins on the Tempo network or in fiat via cards and buy now, pay later.
Both settle payments at the HTTP layer for machine-to-machine use, and both suit pay-per-call API and MCP monetisation. x402 reuses the HTTP 402 Payment Required status code and is Apache 2.0 with a Coinbase-hosted facilitator on Base and Solana. MPP is co-authored by Tempo and Stripe, settles in stablecoins on the Tempo network as well as fiat through Stripe, and reaches merchants through the PaymentIntents API they already use.
Web Bot Auth is a profile of RFC 9421 HTTP Message Signatures for authenticating bots and AI agents. The agent signs each request with an Ed25519 key and publishes its public keys at a well-known directory, so a site can verify the claim cryptographically. It replaces checking a crawler’s IP against a published range list, which only works for the handful of vendors that publish ranges, produces false accusations whenever a list goes stale, and cannot authenticate an agent running on an end user’s own machine. Cloudflare, Amazon, Akamai and OpenAI back it, and an IETF working group was chartered in 2026.
Pay-per-crawl treats crawler access as a metered resource: a site can allow, block, or charge an AI crawler at the network edge. Cloudflare ships it as AI Crawl Control and, from April 2026, is integrating it into GoDaddy hosting. It matters for agentic payments because it settles at the same HTTP layer as x402 and MPP — the request itself is the billable unit, rather than a checkout at the end of a session.
Static PSD2 consent is being extended with policy-based authorisation, explicit delegation and continuous validation. See the Consent and trust section on this page and the Konsentus white paper for detail.
Agentic AI is changing how Open Banking services are executed: agents monitor, decide and act on behalf of users with limited continuous human involvement. That challenges static PSD2 consent models, which assume user-initiated activity and direct TPP execution. Emerging approaches extend consent through policy-based authorisation, explicit delegation and continuous validation so that consent chains—from consumer through TPP to agents and sub-agents—remain visible and constrained while preserving regulatory alignment.
Konsentus’ white paper on Agentic AI and the evolution of consent in Open Banking explores how agentic consent models can support secure, accountable agentic execution and why Open Banking should be treated as a living trust framework that adapts as technology and execution models evolve.
Banks and platforms that let AI agents access accounts and payments (MCP, x402). More on consent and trust above.
Connect to 30+ accounting platforms and ERPs through a single unified API with Apideck.