In March 2026 OpenAI confirmed that Instant Checkout was moving to Apps. The agentic commerce protocol (ACP) that powered it did not disappear. This open standard from OpenAI and Stripe still defines how an agent starts a checkout, passes a payment and gets an order back. This guide covers the ACP flow, its security model and its rivals. It shows what product data your service must support in terms of speed and privacy.
What the agentic commerce protocol is and what changed in 2026
What is the agentic commerce protocol (ACP)?
The agentic commerce protocol is an open standard and interaction model that lets buyers, AI agents and businesses complete purchases. It defines programmatic commerce flows between an agent and merchant systems. An agent can read a catalog, open a checkout and hand over a payment without scraping a web page. The first specification shipped on 29 September 2025 together with Instant Checkout in ChatGPT. A developer gets a reference specification with OpenAPI files and JSON schemas. The standard is published under the Apache 2.0 license and its security and privacy rules apply to every implementation.
Who maintains ACP and how open is it?
The GitHub README, which acts as the community reference, says the specification is maintained by OpenAI and Stripe. The Stripe documentation, read on 26 October 2026, describes ACP as a standard created by Stripe, OpenAI and Meta. The repository lists 28 contributors and dated spec versions from 2025-09-29 to 2026-04-17. The governance rules and the changelog are public. Any business or AI platform can implement the standard. A developer, a retailer or a payment partner can read the specification, open the JSON files and test an API call.
What changed in 2026: Instant Checkout moves to Apps
On 6 March 2026 an OpenAI spokesperson told Digital Commerce 360 that "Instant Checkout is moving to Apps, where purchases can happen more seamlessly". ACP will no longer power purchases made directly from product listings in ChatGPT responses. OpenAI still describes it as the infrastructure that connects users to merchants across the full shopping journey. Instant Checkout was open to US merchants only. Our guide to ChatGPT shopping covers the buyer side of that experience. A user in France could not buy that way. As of 26 October 2026 the ACP repository has no release tag and its last commit dates from 18 July 2026.
How the agentic commerce protocol works, step by step
The five modules of the specification
The Stripe docs list five modules. A developer can use them as a reference for the specification. Each one covers one part of the purchase. The OpenAPI and JSON schemas sit in the spec folder 2026-04-17:
- Agentic checkout: create, update and complete a checkout session with cart, shipping options and payment
- Cart and catalog: browse product catalogs and manage carts before checkout
- Delegated payment: pass payment tokens between customers, agents and businesses
- Delegated authentication: authorize an agent through OAuth 2.0 to act for a customer
- Orders and webhooks: track confirmation, shipping, delivery and refunds
From catalog to order: the checkout flow
A transaction follows six steps. The agent reads the product catalog. It creates a checkout session with the merchant API and updates it with delivery and tax data. The payment provider then issues a token through delegated payment. The agent completes the session and the merchant sends order webhooks for confirmation and shipping. Every transaction ends with a confirmation in the merchant systems. The merchant API runs on the merchant server. The diagram shows who owns each step.
Read it from top to bottom: the agent asks and the merchant decides. The protocol assumes that the catalog data at the first step is already accurate. In the era of agentic commerce the specification checks the format of a message and not the truth of a price. If the price or the stock is wrong, every later step inherits the error.
Delegated payment and the shared payment token
In delegated payment the buyer’s payment provider issues a shared payment token for one purchase. The agent passes that payment token to the merchant and never sees the card number. The official site says businesses can use ACP with any compatible payment provider and that Stripe was the first one with its Shared Payment Token. The merchant keeps the payment processing relationship.
Security and PCI: what the protocol covers
ACP presents itself as secure and PCI compliant. Tokenization keeps payment credentials away from the agent and OAuth 2.0 limits what an agent may do for a customer. Fraud prevention and the privacy policy stay with the merchant and the payment provider. A compliance review should cover each concept before launch. A secure payment needs a token, a scoped authorization for the agent and an audit trail on the order. The protocol gives you the first two.
What the merchant keeps
The merchant stays the merchant of record. You keep the price, the stock, the fulfillment and the customer relationships. Fulfillment rules stay yours. Your pricing logic stays with you. The agent brings the buying intent. The sale happens in a new channel but the contract stays with you. A wrong promise made by an agent is your problem, so the data you expose has to be right.
ACP, UCP, AP2 and MCP: which protocol covers which layer
Which layer does each protocol cover?
The table compares six protocols on layer, owner and spec activity. Figures come from public GitHub repositories on 26 October 2026.
In prose the picture is simple. The Agentic Commerce Protocol covers checkout and payment. The Universal Commerce Protocol (UCP) covers the whole journey from discovery to after-sales. The Agent Payments Protocol (AP2) covers payment authorization. The Model Context Protocol (MCP) is not a commerce standard. It connects a model to tools and data. Stars measure attention and not usage.
UCP and Google’s Universal Cart
Google announced Universal Cart at I/O on 19 May 2026. It launches in the United States first on Search and in the Gemini app. Checkout runs on the Universal Commerce Protocol. Google plans Canada and Australia next and the United Kingdom later. No date has been given for France. Announced retailers include Nike, Sephora, Target and Walmart. For a European brand this means UCP is the protocol to watch for Google surfaces and Google Search. ACP is the one tied to ChatGPT. Retailers that sell in both places need an enterprise view of both flows.
AP2, MCP and agent-to-agent protocols
Google says the Agent Payments Protocol is coming to its products in the coming months. A large language model (LLM) cannot call your catalog alone. An MCP server gives a generative model tool connections to your data so the agent can run a product search or check an order. Each connection adds usage that your team monitors. Agent-to-agent protocols such as A2A let two agents talk to each other. Our guide to MCP and A2A for enterprise AI search explains that layer. Our article on agent-to-agent commerce shows how it works in a sales journey.
Adoption and spec activity, as of October 2026
On 26 October 2026 UCP shows more activity than ACP: a push on the day itself against 18 July 2026 for ACP. Do not read that as a winner: the two cover different surfaces. McKinsey estimates that agentic commerce could orchestrate 900 to 1,000 billion dollars of US B2C retail revenue by 2030. Its worldwide estimate is 3 to 5 trillion dollars.
What supporting a protocol asks from your side
Payment provider and eligibility
ACP works with any compatible payment provider. The payment processor must be able to issue a delegated payment token and a customer never types a credit card number into the conversation. Check this before any build. Check also where each channel is open: Universal Cart starts in the United States. A French brand should confirm availability per surface before it commits engineers.
Being listed is a separate step
Implementing the standard does not list your products. The official FAQ says each AI platform manages its own process for how businesses take part. Discovery mechanisms that let platforms identify ACP merchants are still being built. A compliant checkout is necessary and not sufficient. Visibility in an assistant also depends on the quality of the product data that the agent can read. A good customer experience in an assistant starts with a catalog that agentic commerce systems can parse.
Which protocol to support first
Choose in four steps and review them each quarter. Identify the surfaces where your customers already ask questions: ChatGPT, Gemini or a brand assistant. Check which surfaces are open in your markets. Confirm that your payment provider supports the matching flow. Then audit your product data. Map every source system and every pricing rule. Each tool that touches a product record counts. The first three answers change every quarter. The fourth does not. Answer generation from a thin catalog gives the user a poor result.
Where Kleio fits: the product data behind every protocol
A protocol only moves the data you give it
About 60% of buyers do not know what they want when a complex purchase starts. Our view on agentic commerce explains why that matters for complex sales. An agent has to turn that vague need into a short list. It can do so only if attributes, prices, stock and eligibility rules are complete and current. In most large companies that data sits in dozens of systems. Every client conversation we have exposes the gaps. Artificial intelligence cannot fill them by itself. That is why we solve the data problem first. Orpi went live in three months across 1,250 agencies and 8,000 advisors.
How the Kleio Knowledge Engine exposes a catalog
The Kleio Knowledge Engine distributes a product catalog across three purpose-built stores: product, document and memory. A separate layer handles configuration and governance.
We expose the catalog to AI search through MCP and UCP. The engine reaches 99% precision on queries with sub-3-second responses and no hallucination. Agents answer complex queries from approved data only. The same data feeds an on-site AI shopping assistant. That is the layer a protocol cannot supply.
What Kleio does and does not do in the protocol stack
ACP stays on the merchant and payment side. Kleio is not a payment provider and not a merchant of record. We do not claim that Kleio implements ACP. We work upstream on the data and the agents that rely on it. Deployment takes 8 to 12 weeks from kickoff to production. The platform is SOC 2 compliant and tenant-isolated, with ontologies for seven industries. Our integration work is based on your own stack.
