Three Networks Are Building the Agent Payment Layer in 2025

🇹🇷 Türkçe: Bu yazının Türkçesini oku →

Here is the decision a buyer actually has in front of them. By the end of 2027 a measurable share of your online revenue will arrive through an AI agent, not a person. The question is not whether to let it in. The question is which payment credential the agent is going to present at your checkout, because that choice is already being made for you by the networks you accept today.

Three of the biggest built the answer in 2025. Mastercard shipped Agent Pay in April. Stripe and OpenAI shipped the Agentic Commerce Protocol in September. Visa shipped the Trusted Agent Protocol in October. Each is a different control-point bet, and each already has early retailers on it. If you take cards and accept Stripe you are, quietly, already standing underneath the structure they are agreeing on.

I have watched the agentic commerce story for two years now, and the thing I keep telling clients is that the hype and the plumbing are on different clocks. The hype moves in demo cycles. The plumbing moves in standards cycles. The plumbing wins. Three network-level standards shipping inside six months is the plumbing moving, and that is worth more than any Shopping tab demo you will see this year.

What follows is a read of the three protocols from the merchant’s seat, with the figures their own companies published, and a build section that says what a real WooCommerce estate has to do about any of it. The three brands under the lens: Mastercard Agent Pay, Visa Trusted Agent Protocol, and the Stripe and OpenAI Agentic Commerce Protocol.

Mastercard Built Agent Pay on the Token It Already Owns

Mastercard went first. On 29 April 2025 Jorn Lambert, Mastercard’s chief product officer, announced Agent Pay as the company’s agentic payments program. The structural choice was the interesting part. Rather than invent a new credential, Mastercard extended its existing tokenization, the same mechanism that already sits under mobile contactless payments and card-on-file, into what it calls Agentic Tokens.

The pitch was specific. “The launch of Mastercard Agent Pay marks our initial steps in redefining commerce in the AI era,” Lambert said in the press release carried by the trade press, adding that the company is “keen to collaborate with industry players to advance the standards for agentic payments.” The lanes announced on day one tell you the thesis: Microsoft as the first AI platform partner for consumer use cases, IBM’s watsonx Orchestrate for business-to-business, Braintree and Checkout.com on the acquirer and tokenization side.

• Launched 29 April 2025 by Jorn Lambert, chief product officer, Mastercard. Source: Mastercard press release via Electronic Payments International and PYMNTS, dated 29 April 2025.
• Agentic Tokens extend existing Mastercard tokenization, which already covers mobile contactless and card-on-file, into agent-initiated transactions. They also extend to programmable payments such as recurring subscriptions.
• Named partners at launch: Microsoft (consumer AI), IBM watsonx Orchestrate (B2B), Braintree and Checkout.com (acquirers and tokenization).

The transferable lesson for a buyer is that Mastercard’s answer is to reuse rails you already consume. If your acquirer is Braintree or Checkout.com, or your platform is Shopify-adjacent through Microsoft, you inherit a lot of this without a capital project. That is a quiet but real advantage for a mid-market merchant that does not want to fund an integration programme to be in the next shopping cycle.

Visa Turned Agent Verification Into a Public Protocol

Visa shipped the Trusted Agent Protocol on 14 October 2025, developed with Cloudflare and published both in the Visa Developer Center and on GitHub. The framing was different from Mastercard’s in a way that matters. Visa did not announce a product called Agent Pay. It published a framework and told the ecosystem to build on it.

Jack Forestell, Visa’s chief product and strategy officer, put the merchant problem at the centre. “We believe the entire payments ecosystem has a responsibility to ensure sellers can trust AI agents,” he said, calling out the “no-code functionality for merchants” the protocol targets. The motivating figure Visa cited is the one you cannot argue with: AI-driven traffic to United States retail sites rose by more than 4,700% over the preceding year. If that is your inbound trend, agent verification is not a nice-to-have.

• Launched 14 October 2025 by Jack Forestell, chief product and strategy officer, Visa. Source: Visa press release covered by Electronic Payments International on 15 October 2025.
• Co-developed with Cloudflare, built on the HTTP Message Signature standard and the Web Bot Auth proposal. Published to the Visa Developer Center and GitHub.
• Named partners at launch: Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe, Worldpay. Visa says it is aligning the protocol with the Agentic Commerce Protocol.
• Motivating figure: 4,700% year-on-year rise in AI-driven traffic to United States retail websites, reported by Visa in the launch materials.

The transferable lesson: Visa is treating the problem as identity, not payment. Can the merchant tell a legitimate agent from a bot pretending to be one. That is the layer every store is quietly short of today, because your bot rules at the edge were written for scrapers, not for a paying customer that happens to be software. The partner list is also the tell, with Stripe and Shopify sitting alongside the acquirers. Visa wants its protocol to be the layer under everyone else’s product.

Stripe and OpenAI Shipped the First Live Checkout

While the two networks were mapping standards, Stripe and OpenAI shipped something you can actually buy through. On 29 September 2025 they launched Instant Checkout in ChatGPT and released the Agentic Commerce Protocol, co-developed between the two companies, as the open standard underneath it. Etsy was live for United States shoppers the same day. Glossier, Vuori, Spanx and SKIMS were announced for Shopify merchants to follow.

Stripe framed it in infrastructure terms. “Stripe is building the economic infrastructure for AI,” said Will Gaybrick, Stripe’s president of technology and business. Kevin Miller, head of payments, put the honest version of the problem in print: “Stripe has spent the last 15 years optimizing commerce for human buyers.” Everything the industry built, Miller was saying, was built for the wrong buyer. Fidji Simo, OpenAI’s CEO of Applications, framed the OpenAI side: by co-developing the protocol with Stripe, OpenAI was making it possible for businesses of all sizes to accept agent orders without a bespoke integration per model.

• Launched 29 September 2025. Named executives: Will Gaybrick (president of technology and business, Stripe), Kevin Miller (head of payments, Stripe), Fidji Simo (CEO of Applications, OpenAI). Source: Stripe newsroom, stripe.com/newsroom/news/stripe-openai-instant-checkout.
• Agentic Commerce Protocol gives merchants a single interface for AI agents. Orders pass from ChatGPT to the merchant’s backend through the protocol. Merchants accept or decline, charge payment, remit tax, and fulfil as normal.
• Shared Payment Tokens, the payment primitive, are scoped to a specific merchant and cart total. They do not expose the buyer’s payment credentials. Merchants can process through Stripe or any other provider and still use Stripe Radar for fraud scoring.
• Reach figures in the release: over a million Shopify merchants expected to gain access through the Shopify integration. Every company in the Forbes AI 50 that accepts online payments uses Stripe.
• Named merchants at launch: Etsy (United States, live), Glossier, Vuori, Spanx, SKIMS (Shopify merchants, coming soon).

The transferable lesson here is harder to miss. You can buy things with it today. That is the gap between a standards body and a shipping company, and it is also why the shape of ACP is going to influence the other two more than their press releases suggest. Visa already said it is aligning its Trusted Agent Protocol with the Agentic Commerce Protocol, which tells you where the centre of gravity is.

The Three Converge on One Design

Read the three releases next to each other and the shared answer is hard to miss. All three settled on the same core idea: a scoped, verifiable credential that stands in for the card, tied to a specific merchant and often a specific cart total, with an identity layer underneath so the merchant knows what it is talking to. Mastercard calls it Agentic Tokens. Stripe calls it Shared Payment Tokens. Visa builds the identity half and leaves the token half to the payment companies. The vocabulary is competitive. The engineering is not.

The one thing nobody in the three releases has a comfortable answer for is attribution. When an agent brings in a sale on behalf of a customer who never visited your site, your analytics stack has nothing to attach the revenue to that is not either the agent brand or a generic bucket. GA4 does not natively model an agent as a traffic source. Your ad spend decisions still assume a human funnel. The networks are building the payment half of this, and the measurement half is going to land on the merchant, as it usually does.

What a WooCommerce Store Has to Do About It

Here is where the strategy pieces stop and the build starts. If we were handed a mid-market WooCommerce estate today and told to be ready for agent traffic that actually converts, this is the sequence we would ship, in the order we would ship it, with the honest effort attached.

• Clean product data as the entry ticket. One to two sprints. Agents read structured data, not design. That means a canonical product schema (Product, Offer, AggregateOffer) on every PDP, GTIN or MPN where it exists, canonical price and availability, and variations modelled as proper variations and not as separate products glued together by a plugin. This step pays for itself even if no agent ever visits, because it is also what Google’s shopping surfaces now rank on.
• A machine-readable product endpoint. Two to three sprints. Expose a dedicated feed and a Store API surface that agents can read without scraping the storefront. WooCommerce ships the Store API; the work is in shaping the response, adding the fields an agent needs to compute a cart, and gating it under a key so you can rate-limit it later when you need to.
• Prepared-cart handoff. One sprint. The checkout change is small: accept a hand-off cart from a trusted agent via a signed token that pre-fills the cart, the shipping method and the payment intent, so the agent is not simulating a browser. Your acquirer already has the primitive, whether that is Shared Payment Tokens via Stripe or Agentic Tokens via Mastercard-backed acquirers. Pick the one your acquirer natively supports, do not roll your own.
• Agent identity at the edge. One to two days plus policy time. Whatever bot rules you run at your edge today were written for scrapers. Whitelist the agents you trust, verify them against Web Bot Auth and the Trusted Agent Protocol as those become supported by Cloudflare and other edges, and log the ones you do not recognise rather than block them outright. A paying agent you blocked by accident is worse than a scraper you let through.
• Agent-aware analytics. A few hours of instrumentation and ongoing work. Add an “agent” dimension to GA4 custom definitions and tag the handoff on arrival. Do not wait for Google to ship a native agent-traffic source. Your attribution will be rough at first; it will be rough for everyone at first. The point is to have the dimension in the data model before the volume shows up, not after.
• Policy and merchandising. Four to six weeks of governance work. What SKUs can an agent buy on your behalf. What price can it accept without re-confirming. Can it apply a promotion code. These are not code decisions. These are decisions your commercial team has to make and sign off on, and then your store has to enforce as structured policy, not as a comment in a Slack thread.

A reasonable range for the whole programme on a mid-market WooCommerce estate is eight to twelve weeks of build plus a quarter of measurement before anyone can honestly say what it is worth. If a vendor pitches you a two-week agent-ready package, the pitch is overshooting what the networks themselves have shipped.

What I would tell a board that put this on the November agenda is the thing the three releases do not say out loud. The networks have agreed, in practice if not in press release, that agent commerce is going to run on scoped tokens over verified agents, and the fight is now about who issues the credential and who owns the identity. A merchant does not have to pick a winner. A merchant has to be ready for any of them, because the credential your customer’s agent presents in 2027 is already being negotiated above your pay grade in 2025. If you want a second pair of eyes on the WooCommerce side of that readiness, that is the conversation we are set up to have.