The Agentic Commerce Protocol (ACP): what ChatGPT checkout asks of your online store

Short answer: the Agentic Commerce Protocol (ACP) is the open standard from OpenAI and Stripe for AI agents, starting with ChatGPT, to check out on a store on a shopper’s behalf. Like Google’s UCP, it isn’t a switch you flip: a store has to publish a discovery document, run checkout sessions through a defined set of states, enforce strict idempotency, take or hand off payment, and send signed order updates back to the agent. Here’s what that involves, using the current release (2026-04-17).

What ACP does

ACP covers the checkout end of agent shopping:

• Discovery: what the store supports, which protocol versions, which currencies.
• Checkout sessions: the agent creates a session with the items and the shopper’s details, updates it as choices are made, and completes or cancels it.
• Payment: through a payment handler the store supports, with Stripe’s delegated payment flow as one option.
• Orders: once placed, the store keeps the agent up to date as the order is processed, shipped or refunded.

It’s offered as a REST API and as an MCP binding (five checkout tools), so assistants that call tools can use it too.

The parts a store has to run

1. A discovery document

ACP stores publish /.well-known/acp.json: the protocol version and the versions they support, the API’s base address, the transports on offer (REST and MCP), the services (checkout, orders) and the currencies accepted. Agents read it before anything else.

2. Versioned requests

Every request carries an API-Version header, and a store must refuse versions it doesn’t support with a specific error that lists the ones it does. ACP releases are dated, and agents and stores won’t always move at the same pace.

3. Checkout sessions as a state machine

A session moves through not_ready_for_payment, ready_for_payment, complete_in_progress, completed, canceled and expired. Each request returns the whole session, with messages telling the agent what’s still missing (an address, a delivery option, a payment). Errors split carefully: problems the agent can fix stay as messages on a valid session, while unknown sessions, invalid requests and state conflicts get their own HTTP statuses and error codes.

4. Strict idempotency

Every POST must carry an Idempotency-Key. The store has to echo it, replay the original answer for a retry, tell the agent to wait if the first request is still being processed (409 with Retry-After), and refuse the same key with a different request (422). That’s what stops a dropped connection from creating two orders.

5. Payment

ACP’s checkout completes with payment data from the agent. A store either supports a payment handler the agent can use, or takes part in delegated payment, where a payment provider such as Stripe issues a token limited to that one purchase. Both have security and compliance implications: card data must never pass through anything that isn’t built to hold it.

6. Signed order webhooks

After an order is placed, the store sends order_create and order_update events to the agent, signed with an HMAC (Merchant-Signature) using a secret shared with that agent. They have to be retried when they fail, delivered once, and carry the full order: lines ordered and fulfilled, shipping and tracking, refunds and totals.

7. The details that trip people up

Real implementations meet gaps between the specification, its schemas and its examples: version values, how quantities are expressed, which fields strict schemas allow, how a declined payment is reported. Each needs a decision that stays compatible with every agent that calls the store.

ACP and UCP: do you need both?

They overlap but come from different camps: ACP from OpenAI and Stripe, UCP from Google and partners. AI assistants will use the one their platform supports, so a store that wants to sell through more than one assistant needs both, kept consistent with the same catalogue, prices, stock and delivery rates.

What you can do today

1. Make your product data complete. An agent can only check out what it can find and understand: prices, stock, variants, GTINs and images. See structured product data for AI agents.
2. Run the free check. Its protocol readiness section looks for an advertised ACP checkout, a UCP profile and an MCP endpoint.
3. Let Proxa Monitor watch it once you publish protocol endpoints.
4. Proxa Connect (coming soon). Connect will run ACP, UCP and MCP for your store, starting with WooCommerce, so you don’t build any of this yourself. It isn’t available yet: tell us you’re interested and we’ll let you know when it launches.

In the UK, buying through AI agents isn’t open to stores yet. AI assistants already search for products and send shoppers to the stores they can read, so the product data you fix now pays off straight away, and again when agent checkout arrives.