What Is the Agentic Commerce Protocol (ACP)? How OpenAI’s Standard Works for Merchants
your project?
Key takeaways
- What it is: ACP (Agentic Commerce Protocol) is an open standard for programmatic commerce flows between buyers, their AI agents and businesses. OpenAI and Stripe built it and announced it on 29 September 2025.
- Three flows: a product feed, a set of checkout endpoints, and a delegated payment step that passes a scoped token to your payment provider.
- Your role stays the same: you are the merchant of record. You validate orders, calculate tax, accept or decline, and charge through your own payment provider.
- 2026 changed the picture: OpenAI moved ChatGPT shopping toward product discovery in March 2026, while the protocol kept shipping spec versions. The latest stable one is dated 17 April 2026.
- Where to start: a clean product feed. It is the first thing OpenAI’s onboarding asks for.
When a shopper asks ChatGPT for a waterproof jacket, the answer depends on what the assistant can read from stores. ACP defines how a store makes that data and its checkout available to an AI agent. This guide explains how ACP works, what a merchant implements and what changed in 2026.
What ACP is
ACP is “open source and community-designed” under the Apache 2.0 license. OpenAI and Stripe are its founding maintainers, and the project is on GitHub with dated spec versions: 2025-09-29, 2025-12-12, 2026-01-16, 2026-01-30 and the latest stable release, 2026-04-17. It is still in beta.
The protocol supports physical goods, digital products, subscriptions and asynchronous purchases. It works with REST APIs and with MCP (Model Context Protocol). ChatGPT is the first agent implementation, and Stripe is the first compatible payment provider. Any agent that follows the spec can in principle call an ACP-enabled checkout.
In short: ACP is a contract. The store promises a feed, a set of checkout endpoints and support for a scoped payment token. The agent promises to use them in a defined order.
Who does what
ACP names four roles:
- Buyer: the person choosing products in ChatGPT.
- Agent: ChatGPT, acting for the buyer.
- Merchant: your business. You provide the products and handle order acceptance and payment processing.
- PSP: your payment service provider, which processes the transaction on your behalf.
OpenAI states that it “is not the merchant of record in the Agentic Commerce Protocol.” You bring your own payment provider and handle payments as you would for any other digital transaction.
Flow 1: the product feed
Everything starts with a structured feed. OpenAI’s get-started guide opens with “share a structured product feed.”
- Required fields: item_id, title, description, url, brand, seller_name, image_url, availability and price. At least one of GTIN or MPN is also required.
- Formats: JSONL is preferred. CSV, TSV and gzip-compressed files are also accepted.
- Delivery: OpenAI recommends a hybrid approach. Send the entire feed once a day as a file upload, then push updates throughout the day through the API. Smaller catalogs can use the API alone. Promotions data goes through the API only.
- Freshness: update the feed when a sale starts or ends and submit current stock status with each row.
- Content rules: products must comply with OpenAI’s prohibited-products policy, which excludes adult content, age-restricted items, weapons and deceptive practices.
Access is limited. The integration is “currently available to approved partners,” and merchants apply through the form at chatgpt.com/merchants.
Flow 2: checkout
When a shopper decides to buy, ChatGPT calls your checkout endpoints. You perform validation, determine fulfillment options, calculate and charge sales tax, and decide whether to accept the order. A merchant implements five REST endpoints.
A checkout session moves through defined statuses.
ach session carries a cart with line items, totals (items, subtotal, fulfillment, tax, fee and total), fulfillment options with estimated delivery times, and buyer and payment data. Your responses can include messages with standard codes such as missing, invalid, out_of_stock, payment_declined, requires_sign_in and requires_3ds. The protocol currently models a single shipping address and one selected shipping option per session.
Flow 3: delegated payment
The agent never types a card number into your checkout. The Delegated Payment Spec lets OpenAI pass payment details to your payment provider, which returns a single-use token limited by amount and expiry.
- OpenAI sends the request. Your PSP receives it at POST /agentic_commerce/delegate_payment, with card details (preferably a network token), an allowance (maximum amount, currency, expiry, checkout session and merchant) and risk signals.
- Your PSP returns a vault token. The token looks like vt_... and is scoped to the allowance.
- OpenAI forwards the token when it completes the checkout, and you charge within those limits.
If you handle cardholder data directly in this step, it can affect your PCI scope. OpenAI may ask for PCI compliance attestation before enabling production access.
How Stripe Shared Payment Tokens work
Stripe’s Shared Payment Token (SPT) is the first implementation that meets the Delegated Payment Spec. Stripe describes an SPT as a scoped grant to use the customer’s payment method.
- The agent grants the token to your Stripe profile, with usage and expiration limits.
- Limits include the currency, a maximum amount and an expiry time. The agent sets the maximum to match the total of the transaction.
- You create a PaymentIntent and pass the token as shared_payment_granted_token. Stripe clones a new PaymentMethod from the customer’s original one, so refunds and reporting behave as usual.
- Webhooks tell you the status. You receive an event when the token is deactivated, which happens when it is consumed, expired or revoked. A revoked token cannot create a payment.
- Availability is regional. Stripe lists the US, Canada and select European countries.
Request security
Every ACP request runs over HTTPS and carries a set of headers.
Before production, OpenAI expects sandbox testing. It covers session creation with and without a shipping address, shipping option updates, payment tokenization, order completion with an HTTP 201 Created response, webhook delivery with valid HMAC signatures, error handling and idempotency. All traffic to your endpoints must use TLS 1.2 or later on port 443 with a valid public certificate.
Order webhooks
After an order exists, you tell OpenAI what happens to it. Your system sends order_created and order_updated events to OpenAI’s webhook endpoint, signed with an HMAC key OpenAI provides.
- Statuses: created, manual_review, confirmed, canceled, shipped and fulfilled.
- Refunds: each event lists refunds by type (store_credit or original_payment) and amount.
What changed in 2026
On 24 March 2026, OpenAI revamped shopping in ChatGPT. It said the first version of Instant Checkout “did not offer the level of flexibility that we aspire to provide,” and refocused on product discovery. Merchants keep their own checkout, and they can build ChatGPT apps for deeper integrations. Walmart launched its own in-app experience in ChatGPT with account linking, loyalty programs and its own payment system.
OpenAI named Target, Sephora, Nordstrom, Lowe’s, Best Buy, The Home Depot and Wayfair among the retailers that integrated ACP for product discovery. Shopify Catalog feeds product data into ChatGPT.
The protocol itself kept moving. Its spec now covers cart management, order tracking and MCP integration alongside checkout. OpenAI’s commerce documentation today describes three parts: product feeds, agentic checkout and delegated payment.
What this means for merchants
- Start with data. The product feed is the first step in OpenAI’s onboarding and drives how your products appear.
- Expect an approval step. Access is limited to approved partners today.
- Keep checkout under your control. You decide how orders are validated, taxed and fulfilled.
- Check your payment provider. Stripe offers Shared Payment Tokens. Other providers are expected to follow.
- Plan for both protocols. Google’s UCP covers Google surfaces. The shared groundwork serves both. See ACP vs UCP.
If you want to know which of these your store already meets, our agentic commerce readiness audit checks it in one week for a fixed price.
FAQ
Is ACP only for Stripe merchants?
No. ACP is an open standard, and merchants bring their own payment provider. Stripe is the first compatible provider and offers Shared Payment Tokens, but the specification is designed to work with other processors.
Is OpenAI the merchant of record?
No. OpenAI states that it is not the merchant of record in ACP. You are, and you handle fulfillment, support and payments as for any other order.
Can any store join?
Not yet. OpenAI’s integration is currently available to approved partners, and merchants apply through chatgpt.com/merchants. The specification itself is public on GitHub.
Did OpenAI drop ACP when it scaled back Instant Checkout?
No. In March 2026 OpenAI deprioritized Instant Checkout and shifted ChatGPT shopping toward discovery. Retailers integrated ACP for product discovery, and the protocol released a new stable spec on 17 April 2026.
Conclusions
How is ACP different from UCP?
They share the same goal. ACP starts from a feed you share with OpenAI and serves ChatGPT. UCP starts from a profile you host and serves Google surfaces. The full comparison is in our guide.