How to Choose an Authorization Protocol for an Agent Product — a decision path through the fragmented rail, not the press releases

Choosing an authorization protocol for an agent product in 2026 is a rail choice, not a feature choice: card vs stablecoin decides most of what follows, and the honest filter is shipped-and-verifiable status, not the partner logos on a launch page. This page gives the decision factors, a maturity ranking, lock-in risks, and two worked examples — all traceable to the notes, none extrapolated.

Payment rail — card vs stablecoin

Card-rail protocols (AP2, ACP via Stripe/Mastercard, Visa Intelligent Commerce, AP4M's card-rail option) settle through card networks and merchant acquiring; stablecoin-rail protocols (x402, MPP, Coinbase Agentic Wallets) settle on-chain — x402 "supports Base, Ethereum, Polygon, Solana, Avalanche, Sui, and other chains, with zero processing fees beyond on-chain gas" — FONTE: https://www.crossmint.com/learn/agentic-payments-protocols-compared (neither cited note states a settlement latency in days or minutes; that comparison is not made here). On fees: x402 on Solana runs $0.00025/transaction — FONTE: https://solana.com/x402/what-is-x402 — versus Stripe's "1.5% on stablecoin charges" with gas absorbed by Stripe — FONTE: https://eco.com/support/en/articles/14895614-stablecoin-payment-processor-fees-compared-2026 (that comparison table gives no figure for Stripe's standard card pricing, so no card percentage is quoted here). For the underlying interchange-fee arithmetic behind why fixed-fee card components break sub-dollar payments, see Card Network Fees vs Micropayments — the interchange arithmetic, re-anchored to the primary schedules.

Consumer vs B2B / agent-to-agent

Consumer shopping agents (human authorizes an agent to buy) fit ACP (structured checkout, product discovery, merchant integration) or AP2 (authorization/mandate layer riding any rail) — FONTE: https://www.crossmint.com/learn/agentic-payments-protocols-compared, which frames ACP as best for "shopping agents that interact with merchant catalogs" and AP2 as ideal for "enterprise multi-agent systems that need auditable authorization." Agent-to-agent / API metering (machines paying machines, no human in the loop) needs x402 or MPP, both built for micropayments and streaming settlement — FONTE: https://www.crossmint.com/learn/agentic-payments-protocols-compared, which says "Use x402 for the machine economy. If your agents pay for API calls, data feeds, compute resources, or services from other agents"; openfort independently places x402 and MPP at the settlement layer. This split is developed further in Agent-to-Agent vs Agent-to-Merchant Payments — the split that decides which protocol set actually applies.

Spend-limit enforcement — network vs application level

On-chain/network-enforced limits (Coinbase Agentic Wallets, x402 smart contracts) bind session caps and per-transaction limits cryptographically to the wallet/mandate, so they hold even if the application is compromised — FONTE: https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained (programmable guardrails: "session caps, transaction limits, and enclave isolation"; the wallets are non-custodial — keyshares are split between Coinbase and the operator's CDP project and generated inside an AWS Nitro Enclave, so the raw key "is never reconstituted in plaintext on a normal host"). Application-level enforcement only (ACP tokens, some AP2 implementations) relies on the payment processor checking each request; the agent still holds the credential and could exceed limits if the app code is compromised — FONTE: https://github.com/agentic-commerce-protocol/agentic-commerce-protocol (the ACP spec does not itself specify network-level enforcement of token limits). Coinbase's MPC model (launched Feb 11, 2026) splits private keys across trusted execution environments and lets developers set time-bound limits, e.g. "$1.00, expires in 5 minutes" — FONTE: https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets. Full field-by-field comparison across all five protocols: Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives.

Geographic reach

AWS AgentCore Payments (x402-based, preview May 7, 2026) covers US East (N. Virginia), US West (Oregon), Europe (Frankfurt), Asia Pacific (Sydney) — FONTE: https://agenticplug.ai/blog/what-is-amazon-agentcore-payments. Visa Intelligent Commerce is explicitly pre-production ("in the process of development and deployment... may not be available in all markets"), rolling out Europe/UK first, then Asia Pacific and Latin America — FONTE: https://developer.visa.com/capabilities/visa-intelligent-commerce + https://eco.com/support/en/articles/14839400-what-is-agentic-commerce-the-2026-guide. For Mastercard AP4M (announced June 10, 2026) these notes contain no regional-coverage data at all, so no geographic claim is made here. The x402 Foundation became operational July 14, 2026 under Linux Foundation stewardship with 40 members; premier members span payment and infrastructure players globally (Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Shopify, Solana Foundation, Stellar Development Foundation, Stripe, Visa) — FONTE: https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications (the x402 whitepaper itself contains no mention of the Foundation; the protocol donation was announced Sept 23, 2025 — FONTE: https://eco.com/support/en/articles/14845479-ap2-agent-payments-protocol-explained).

Current Maturity Ranking by Shipped-and-Verifiable Status

Use this ranking — not the partner-logo count — as the primary filter. Full evidence trail per protocol: Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols.

Tier 1 — demonstrated production volume, external implementations exist

- x402 (Coinbase; Linux Foundation steward as of July 2026): "165M+ transactions" — FONTE: https://eco.com/support/en/articles/14845479-ap2-agent-payments-protocol-explained — while openfort, writing in March 2026, counts "over 140 million cumulative transactions with $600+ million in payment volume" and a peak of "roughly 1 million transactions per week" in October 2025 — FONTE: https://www.openfort.io/blog/agentic-payments-landscape. Stripe integrated x402 for USDC on Base in February 2026 — FONTE: https://www.crossmint.com/learn/agentic-payments-protocols-compared; Cloudflare co-founded the x402 Foundation in September 2025 (openfort); AWS launched AgentCore Payments on x402 — FONTE: https://agenticplug.ai/blog/what-is-amazon-agentcore-payments. (The $600M is stated by the source as cumulative payment volume, not an annualized rate — see x402 'Tens of Millions of Transactions': Reconciling the Claim — a number without a base is not a fact for the reconciliation against the independent Bazaar enumeration.) - MPP (Stripe/Tempo): "launched on March 18, 2026 alongside Tempo's mainnet" and "launched with 100+ integrated service providers, including Browserbase, DoorDash, Nubank, Ramp, and Revolut"; supports stablecoins on Tempo, fiat cards via Stripe, BNPL (Affirm, Klarna), and Bitcoin via Lightning through Lightspark — FONTE: https://www.openfort.io/blog/agentic-payments-landscape.

Tier 2 — spec published, reference implementations exist, partnerships announced but limited external deployment: - AP2 (Google, announced September 16, 2025): reference implementations in TypeScript and Python, plus a runnable samples directory with merchant, buyer agent and payment server; "60+ launch partners including Mastercard, PayPal, Coinbase, American Express, and Salesforce" — FONTE: https://eco.com/support/en/articles/15192002-ap2-protocol-explained-google-s-agentic-commerce-standard-2026. The card-rail deployments on record are pilots (Mastercard's Agent Pay acceptance framework with PayPal, announced Oct 27, 2025) and "card-rail proof points are still pending" — FONTE: https://eco.com/support/en/articles/14845479-ap2-agent-payments-protocol-explained. - ACP (OpenAI/Stripe, Apache 2.0, status badge "Beta", latest stable spec version 2026-04-17): "first implemented by both OpenAI and Stripe" — FONTE: https://github.com/agentic-commerce-protocol/agentic-commerce-protocol. ACP was announced September 29, 2025 alongside ChatGPT Instant Checkout, which started with Etsy sellers; Stripe's Agentic Commerce Suite went live Dec 11, 2025; OpenAI retired Instant Checkout on March 24, 2026 while the spec persists — FONTE: https://eco.com/support/en/articles/14839406-stripe-link-agents-and-x402-explained. From March 2026 Shopify products are discovered in ChatGPT and the purchase completes "on the merchant's own online store" — FONTE: https://www.digitalcommerce360.com/2026/03/17/shopify-integration-with-chatgpt-changes/. PayPal announced in October 2025 it would adopt ACP for checkout in ChatGPT.

Tier 3 — spec draft or primarily marketing announcements, limited external verification: - AP4M (Mastercard, announced June 10, 2026): "More than 30 companies have signed on as early partners", named ones including Stripe, Coinbase, Cloudflare, Polygon, OKX and Ant International; agent permissions recorded on Polygon, Solana and Base; no full public technical spec found, settlement economics not fully disclosed — FONTE: https://www.cryptopolitan.com/mastercard-agent-pay-for-machines-protocol/ (Mastercard's own press release at https://www.mastercard.com/global/en/news-and-trends/press/2026/june/mastercard-launches-agent-pay-for-machines.html returns HTTP 403 to both WebFetch and curl, so the figures here rest on press coverage, not the primary source). - Visa Intelligent Commerce: explicitly pre-GA — "This product is in the process of development and deployment. Depictions are representations of potential features and sequences. May not be available in all markets." — FONTE: https://developer.visa.com/capabilities/visa-intelligent-commerce (that page states no partner counts, sandbox-project counts or dates; pilot partners named elsewhere are Skyfire, Nekuda, PayOS and Ramp, with end-to-end purchases completed in closed beta — FONTE: https://eco.com/support/en/articles/14839400-what-is-agentic-commerce-the-2026-guide). - Coinbase Agentic Wallets (launched Feb 11, 2026): documented features (spend limits, x402 support, gasless Base settlement), but independent (non-Coinbase) usage evidence is limited to Coinbase's own announcements — FONTE: https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets (that page returns HTTP 403 to automated fetches; the launch date and guardrail features are corroborated by https://eco.com/support/en/articles/14845485-coinbase-agentic-wallets-explained).

Lock-in Considerations

The category is fragmenting fast: eco.com's survey of the field sets AP2, Visa's TAP, ACP and x402 side by side, plus Mastercard's Agent Pay acceptance framework, and its comparison table credits only x402 with a transaction figure ("165M+ transactions") while the others are recorded by spec status and pilots — FONTE: https://eco.com/support/en/articles/14845479-ap2-agent-payments-protocol-explained. No protocol has been formally discontinued as of August 2026, but ChatGPT Instant Checkout (ACP-based) was retired from in-chat purchases on March 24, 2026 while the ACP spec itself stayed live — FONTE: https://eco.com/support/en/articles/14839406-stripe-link-agents-and-x402-explained. (No source in these notes gives a merchant count for how many went live before the retirement.) See Announced and Not Shipped — the graveyard list that keeps the rest of this wiki honest for the fuller graveyard/vaporware tracking.

Interoperability across protocols is limited: most operate at different, complementary stack layers rather than being substitutable — AP2 (authorization) + ACP (checkout) + x402 or MPP (settlement) can compose in one stack, and openfort describes the composed flow explicitly: the agent provisions a SharedPaymentToken through Stripe for the ACP checkout, pays per request via x402 or streams via an MPP session, and "the payment mandate from AP2 travels with each transaction, letting the provider verify authorization" — FONTE: https://www.openfort.io/blog/agentic-payments-landscape. Google has also shipped an A2A x402 extension with Coinbase, showing AP2 and x402 composing. Detail on which pairings actually interoperate vs are marketing-only claims: Interoperability or Walled Gardens? Cross-Protocol Compatibility — what a builder actually integrates when an AP2, ACP, x402 and UCP agent all show up.

x402 currently holds the clearest production-traction lead (140M+ cumulative transactions per openfort, "165M+" in eco's later table, plus Linux Foundation stewardship); ACP and AP2 are backed by major platforms (OpenAI/Stripe, Google respectively) but no source in these notes reports comparable transaction volume for them; MPP is newly launched (March 2026) with 100+ integrated providers at launch and no published volume figure — FONTE: https://www.openfort.io/blog/agentic-payments-landscape + https://eco.com/support/en/articles/14845479-ap2-agent-payments-protocol-explained.

Worked Decision Example 1: Consumer Shopping Agent

Scenario: an agent buying a specific retail item on a human's behalf (e.g. "find me a ceramic mug under $40 on Etsy").

1. Rail: card network preferred for consumer trust and chargeback protection, though stablecoin is viable if merchants accept it. Choose ACP + Visa Intelligent Commerce for the card-rail path. 2. Authorization layer: ACP alone handles the checkout flow (cart, order, fulfillment); layer AP2 on top only if you need cryptographic proof of user intent for regulatory/dispute reasons. For most consumer shopping, ACP alone is sufficient. 3. Payment provider: Stripe (Agentic Commerce Suite, live since Dec 11, 2025) or PayPal (announced ACP adoption in October 2025). ChatGPT Instant Checkout is no longer such a channel: it was retired on March 24, 2026 and Shopify purchases now complete on the merchant's own store. 4. Lock-in mitigation: ACP is Apache 2.0 open-source, so it isn't a single-vendor lock-in; if momentum stalls, migrate the authorization layer to AP2 + Visa IC while keeping merchant discovery/checkout logic separate.

Recommendation from the notes

start with ACP via Stripe — crossmint's rule is "Use ACP for shopping agents that interact with merchant catalogs", and openfort's is "A shopping agent only needs ACP" — while noting crossmint's own caveat that after OpenAI "pivoted to an app-based model in March 2026" the protocol is "still finding its production form". Add Visa Intelligent Commerce as a secondary rail only once it exits development status, and use AP2 mandates for order-level audit trails if merchants require dispute evidence — FONTE: https://www.crossmint.com/learn/agentic-payments-protocols-compared + https://www.openfort.io/blog/agentic-payments-landscape.

Worked Decision Example 2: Agent-to-Agent API Metering

Scenario: agent A pays agent B for a compute task, no human in the loop.

1. Rail: stablecoin settlement is effectively required — sub-cent fees are unavoidable on card rails. Choose x402 or MPP. 2. Protocol pick: choose x402 for HTTP-native payments (server responds with 402 Payment Required), true micropayment costs (Solana "$0.00025 transaction costs" — FONTE: https://solana.com/x402/what-is-x402; on Base these notes record only "zero processing fees beyond on-chain gas", no per-transaction figure), no merchant account required, and Linux Foundation governance stability (as of July 2026). Choose MPP instead for Stripe integration (PaymentIntents API), streaming micropayments within a pre-authorized session, fiat-card top-ups alongside stablecoins, or Tempo (an L1 purpose-built for agent payments). 3. Spend limits: use Coinbase Agentic Wallets (session caps + per-transaction limits, x402-native) for network-enforced limits, or build application-level checks against MPP's pre-authorized per-session spending model. 4. Settlement asset: USDC on Base is the de facto standard for x402 as of April 2026 (Coinbase Agentic Wallets default, Stripe's February 2026 x402 integration); use Tempo stablecoin or USDC on Tempo if on MPP. 5. Lock-in mitigation: x402 is a protocol-level standard under Linux Foundation stewardship, so switching providers later is feasible; MPP is Stripe-controlled, so diverging from Stripe's roadmap means migrating from the PaymentIntents API to raw HTTP-402 handling.

Recommendation from the notes

start with x402 on Solana or Base (lowest fees, most production traction, Linux Foundation stewardship reduces vendor lock-in); monitor MPP if already Stripe-integrated and value the streaming primitives; use Coinbase Agentic Wallets for managed MPC custody with enclave-isolated keyshares, or self-hosted smart contracts for full control — FONTE: https://www.openfort.io/blog/agentic-payments-landscape.

Why This Page Serves the Wiki's Objective

This wiki's objective is to let a reader tell apart a shipped, independently-verified protocol from a press release, and a number with a stated base from one without. This page is the point where that discipline turns into a decision: it never recommends a protocol on partner-list size or launch-announcement tone alone — every recommendation above traces to a maturity tier built from the same evidence bar defined in How to Verify an Agent-Payment Protocol Claim Before Citing It — the four checks this wiki runs on every page and detailed per-protocol in Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols. A builder using this page should walk away knowing not just which protocol to integrate first, but which claims about it are still marketing.

Related

- Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols — the underlying evidence bar (named launch partner vs shipped code) behind the maturity ranking used here. - Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives — the field-by-field detail behind the "network vs application level" spend-limit distinction summarized above. - Card Network Fees vs Micropayments — the interchange arithmetic, re-anchored to the primary schedules — the interchange-fee arithmetic behind why card rails structurally lose on micropayments. - Agent-to-Agent vs Agent-to-Merchant Payments — the split that decides which protocol set actually applies — the deeper split behind why Worked Example 1 and Worked Example 2 land on different protocol families. - Announced and Not Shipped — the graveyard list that keeps the rest of this wiki honest — tracks which of these protocols later stall or die, keeping this page's "current" ranking honest over time.