ACP explained: how an agent actually checks out

When OpenAI and Stripe published the Agentic Commerce Protocol, most of the commentary focused on ChatGPT checkout. That misses the point. ACP is a wire format for any agent to buy from any merchant — and the spec is small enough to implement in a weekend.

The protocol has three moving parts: a product feed the agent can read, a checkout API the agent can drive, and delegated payment so the buyer's card never touches the merchant's servers unencrypted.

The checkout lifecycle

An agentic checkout is a state machine. The agent creates a checkout session, updates it as the buyer decides (address, shipping option, quantity), and completes it with a payment token. Every state transition is a plain HTTPS call:

POST /checkout_sessions          → create
POST /checkout_sessions/:id      → update items, address
POST /checkout_sessions/:id/complete
     { payment_token }           → order created

The subtle part is idempotency. Agents retry. If your complete endpoint isn't idempotent, a flaky connection means a double charge — and an agent will not apologize to your customer for you.

async function completeCheckout(sessionId, paymentToken, idemKey) {
  const existing = await db.completions.findByIdemKey(idemKey);
  if (existing) return existing.order; // safe retry

  const order = await charge(sessionId, paymentToken);
  await db.completions.record(idemKey, order);
  return order;
}

Where UCP fits

Google's Universal Commerce Protocol attacks the same problem from the discovery side: it standardizes how a storefront describes itself to agent surfaces. In practice you'll implement both — UCP to be found, ACP to be bought from. They share more DNA than either camp admits.

An agent that can find you but not buy from you is a worse experience than not being found at all.

If you'd rather not build the plumbing yourself, that's what the products are: the protocol plumbing, delegated payments, webhooks, and test suites — ready to point at your stack.