Agentic Commerce Protocol (ACP) — the checkout-layer spec Stripe and OpenAI ship, and the deployment it already killed

The Agentic Commerce Protocol (ACP) is Stripe and OpenAI's open, Apache-2.0 spec for letting an AI agent complete a purchase: a Shared Payment Token (SPT) primitive for delegating payment without exposing card details, plus checkout/cart/feed APIs. Version 2026-04-17 is the current stable snapshot and is itself marked beta. Its headline deployment — ChatGPT Instant Checkout — shipped and was discontinued five months later, which makes this page a live test case for the wiki's own rule: shipped spec, real deployment, and figure with a base are three different claims, and ACP currently gives you the first two but very few of the third.

Spec home, maintainers, version history

- Repository: https://github.com/agentic-commerce-protocol/agentic-commerce-protocol — public, Apache 2.0 license. - Maintainers: OpenAI and Stripe as founding maintainers, with Meta as co-developer — Stripe's own docs describe ACP as "currently maintained by OpenAI and Stripe" (https://docs.stripe.com/agentic-commerce/acp). - Initial release: September 29, 2025, announced as immediately available for US users (https://stripe.com/newsroom/news/stripe-openai-instant-checkout). - Current stable version: 2026-04-17, labeled beta in the repo. - Versioning scheme: date-based (YYYY-MM-DD), each tag a complete snapshot. - Release timeline (from the repo changelog): 2025-09-29 initial (agentic checkout, payment delegation) → 2025-12-12 fulfillment enhancements → 2026-01-16 capability negotiation → 2026-01-30 extensions and payment handlers → 2026-04-17 cart, feed, orders, authentication, and MCP support. - An unreleased/ directory in the repo holds specs actively in development beyond the 2026-04-17 snapshot — the project is still moving, not frozen.

Beta status

the entire 2026-04-17 version carries a beta label in the repo itself, and its newest features (cart, feed, orders, auth, MCP) were roughly four months old as of August 2026 — short for a payments spec to be called stable. What "outside implementation" means for a spec still in beta is exactly the test in How to Verify an Agent-Payment Protocol Claim Before Citing It — the four checks this wiki runs on every page.

Building blocks

- Agentic Checkout: a composable API to create, update, and complete a checkout session — cart management, fulfillment options, payment processing (Stripe docs, https://docs.stripe.com/agentic-commerce/acp). - Cart and Feed: browse a product catalog and manage a cart before checkout. - Payment delegation via Shared Payment Tokens (SPTs): the core primitive. An SPT lets an agent initiate a payment without ever seeing the buyer's card details; each token is issued to a Stripe profile with usage and expiration limits set by the agent (https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens). - SPT scoping: SPTs are programmable — scopeable to one specific business, limited by time or amount, revocable at any moment, and observable through webhook events. This is the exact mechanism to compare against AP2/AP4M/Visa in Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives. - Delegated authentication via OAuth 2.0: agents authenticate as themselves through an OAuth 2.1 client-credentials-style flow; a request carries both the agent's own identity and proof that a specific user authorized that specific agent (unverified beyond general web-search characterization — no primary OAuth section of the spec was read directly). - MCP support: added in the 2026-04-17 release, for integration with LLM tool-calling stacks.

What an SPT is not

it is a Stripe-issued token, opinionated toward one merchant / one cart / one charge — narrower in scope than a cryptographic mandate. See the comparison below.

ChatGPT Instant Checkout — shipped, then discontinued

- Launched September 29, 2025 (https://stripe.com/newsroom/news/stripe-openai-instant-checkout). - Discontinued March 4, 2026, roughly five months after launch (https://www.hypotenuse.ai/blog/chatgpts-instant-checkout-the-next-phase-of-agentic-commerce). - OpenAI's stated reason: the initial version "did not offer the level of flexibility that we aspire to provide"; the same source names the technical gaps — no real-time inventory sync, no sales-tax mechanism, inadequate fraud prevention. - Adoption at shutdown: no verified, sourced merchant-count figure could be confirmed here — a widely-repeated "fewer than 15 Shopify merchants" figure does not actually appear in the Hypotenuse source it is usually attributed to, and no primary source with a number-with-a-base was found. Treat merchant adoption as qualitatively low (see the discontinuation itself as the evidence) but not quantified until a properly sourced figure turns up. - Etsy reached "something resembling scale" relative to other platforms, but its volume was still a "rounding error against total platform GMV" (unverified beyond a web-search characterization, no primary Etsy source opened). - Context only, not evidence of realized commerce volume: ChatGPT's reported 800-900 million weekly active users and 50 million daily shopping-related queries (unverified, web-search only) — these describe the addressable surface Instant Checkout had access to, not what it converted.

Post-Instant-Checkout pivot to product discovery

- Target, Sephora, Nordstrom, Lowe's, Best Buy, Home Depot, Wayfair are reported to have integrated ACP for product discovery, with checkout staying on the merchant's own site — i.e. these are not full agentic-checkout deployments (unverified, web-search only, no primary retailer source opened). - PayPal committed, per Stripe's own announcement, to bring "tens of millions of additional small businesses" onto ChatGPT commerce during 2026 — an announcement figure, not a measured one; do not cite it as realized volume. - Google's reference implementation reportedly powers checkout inside AI Mode in Search and the Gemini app using stored Google Pay credentials (unverified, web-search only). - Perplexity's Instant Buy is reported to have adopted ACP (unverified, web-search only, sourced only from the Hypotenuse blog).

Net read: ACP's flagship in-chat checkout product failed commercially within five months and was retired; the protocol survived by narrowing to a discovery layer sitting in front of merchant-owned checkout. That is a materially different (and much less load-bearing) claim than "ACP powers agentic checkout at major retailers," which is how it is often summarized.

ACP tokens vs. AP2 mandates vs. card-network agent tokens

*(Everything in this section beyond the SPT description above is sourced only to general web-search characterizations, not to a primary spec document from Google, Visa, or Mastercard — treat as directional, not verified.)*

- Issuer: an SPT is issued by the payment provider (Stripe); an AP2 mandate is user-signed, a tamper-evident artifact tied to the user's own keypair — a different trust root. - Scope: SPT is opinionated about checkout flow (one merchant, one cart, one charge); AP2 sits earlier in the authorization stack, providing a cryptographic mandate that can attest to broader agent authority. See Authorization Layer vs Settlement Layer — the split every agent-payment protocol page in this wiki must be read against for where each sits. - Revocation: SPT revokes through Stripe's own token system (time/amount limits, direct revocation); AP2 is described as using a registry-based revocation list a merchant checks before processing — a different operational model, compared field-by-field in Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives. - Payment-method coupling: the SPT is coupled to Stripe's own payment infrastructure; Visa/Mastercard agent tokens are described as riding the existing card networks instead (inferred, not from a Visa/Mastercard primary source — see Visa Intelligent Commerce: Tokenized Agent Credentials — the spec-vs-announcement test applied to Visa's own numbers and Mastercard AP4M — an announced authorization layer, not yet a published spec or a shipped integration for what those pages verify independently). - Composability, as claimed: "ACP and AP2 compose, so an agent can carry an AP2 mandate into an ACP checkout, giving the merchant a signed pre-authorization plus a scoped payment token" — a claim found only via web search, not confirmed against either spec's own interoperability section. Mark this (unverified) until a primary source is opened. - The broader ecosystem framing — a large enterprise supporting ACP for shopping, AP2 for internal governance, and x402 for machine-to-machine data access simultaneously — is likewise unverified beyond web search; it describes a plausible multi-protocol future, not a documented deployment.

What does NOT work / what remains fragile

- ChatGPT Instant Checkout itself did not work as a business, independent of the protocol's technical soundness: a shutdown roughly five months after launch, with no verified merchant-count figure surviving fact-check, is still a demand-side failure, not a spec bug. Anyone citing ACP as proof that in-chat agentic checkout works should be pointed at the discontinuation itself; a specific adoption number should not be cited until a properly sourced one is found. - The spec is still beta at its latest snapshot (2026-04-17), with an unreleased/ branch showing active, unfinished design work — cart, feed, orders, auth, and MCP support are all under five months old as of this page's writing. - Composability claims with AP2 and card-network tokens are unverified here — they come from secondary web-search characterizations, not from reading the interoperability sections of the ACP or AP2 specs directly. Do not cite the "ACP + AP2 compose" line as confirmed until Google AP2 — the one agent-payment authorization spec that shipped code, not just a press release independently verifies it from the AP2 side. - Independent, non-Stripe/OpenAI/Google implementations are thin. Reported third-party production implementations are limited to discovery-layer integrations (commercetools, Shopify, Etsy per web search); no evidence surfaced here of an outside party implementing the full agentic-checkout/payment-delegation flow. This page's evidence should feed directly into Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols rather than being treated as a verdict on its own.

Why this matters for the wiki's objective

This page is the wiki's concrete instance of the "announcement vs. shipped vs. figure-with-a-base" test from How to Verify an Agent-Payment Protocol Claim Before Citing It — the four checks this wiki runs on every page: ACP has a real public spec with a version tag (passes), a real shipped deployment (passes — it launched and ran for months), and then a discontinuation the marketing framing of "Stripe and OpenAI power agentic commerce" tends to omit. It also fails part of the test on its own terms: the merchant-adoption number that would make the failure a "figure-with-a-base" claim does not survive fact-checking back to its cited source, so this page can assert the discontinuation but not a specific adoption count. Anyone building on ACP, or comparing it to AP2/AP4M/Visa in Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives, needs the discontinuation date and should treat any specific merchant-adoption figure as unverified until sourced directly.

Related

- Authorization Layer vs Settlement Layer — the split every agent-payment protocol page in this wiki must be read against — SPTs sit at the authorization/delegation layer this wiki maps; use that page to place ACP against AP2, AP4M, and Visa without re-deriving the taxonomy here. - Google AP2 — the one agent-payment authorization spec that shipped code, not just a press release — the mandate-based alternative ACP is claimed to "compose" with; verify that claim from the AP2 side before treating it as confirmed. - Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives — the side-by-side table where SPT scoping, revocation, and expiry get compared field-by-field against AP2 mandates, AP4M permissioning, and Visa token scoping. - Outside Implementations Tracker — separating shipped code from launch-partner press releases across the five agent-payment protocols — feed ACP's thin independent-implementation evidence into the cross-protocol ranking rather than judging it in isolation. - How to Verify an Agent-Payment Protocol Claim Before Citing It — the four checks this wiki runs on every page — the method this page follows; use it again on any new ACP claim before citing it elsewhere in the wiki.