Payments for AI agents: wallets, tokens and handing back

When an AI agent shops for someone, the hardest step is the last one: paying. Here are the ways payment can work, from handing back to the person, to wallets, to the new delegated payment programs, and what your store should do about each one now.

How agents pay today

Many AI agents that shop on websites are built not to pay on their own. A browser agent finds the product, picks the size, fills the cart and reaches the payment step. Then it stops and hands control back to the person, who approves the payment themselves. The person, their bank and your payment provider all want a human to say yes to spending money.

The payment step can go one of three ways:

• The agent hands back to the person. The person pays on your checkout page, the same way they would without an agent. This works on any store today, as long as nothing breaks during the handoff.
• The person pays with a wallet. Apple Pay or Google Pay lets them approve in one step on their phone or computer, which makes the handoff quick.
• The agent pays with a delegated credential. The person gives the agent limited permission to pay, through a program run by a card network, a payment provider or a protocol. This is new, and support depends on your platform and payment provider.

1. Agent shops Finds the product, picks options, fills the cart
2. Agent reaches payment Confirms the full total with the person
3. Person takes over Pays on your page, often with a wallet
4. Order placed Confirmation shown in text the agent can read back

Getting the agent to the payment step is covered in how to make checkout work for AI shopping agents.

Make the handoff to the person work

Handing back works on every store today, so it deserves the most care. It fails in predictable ways: the cart empties, the person lands on a different page from the one the agent reached, or the total changes after the agent quoted it.

• Keep the cart alive. A person may come back to approve a purchase minutes or hours after the agent built the cart. A cart that clears after a short timeout throws away the agent's work.
• Show the full total before payment. Product prices, delivery, tax and any discount, in text, on the page before the payment form. The agent can then tell the person exactly what they're agreeing to.
• Keep the payment step on a stable page. If the person opens the checkout from a link the agent gives them, they should land on the same step with the same cart.
• Confirm in text. An order number and a summary on the confirmation page, not only an animation, so the agent can report back what happened.
• Don't force an account to pay. An agent can't create an account for someone. Offer guest checkout, with sign-in as an option.

Handoff that loses the sale

• Cart clears after a short timeout
• Delivery and tax appear only after card details
• Account required before payment
• Confirmation shown only as an animation

Handoff that keeps it

• Cart survives until the person returns
• Full total in text before the payment form
• Guest checkout, sign-in optional
• Order number and summary in text

Wallets and saved payment methods

Wallets fit the handoff well. Apple describes Apple Pay as letting people provide payment, shipping and contact information with Face ID, Touch ID or a double click on Apple Watch. Google Pay offers a similar button for websites. One confirmation on a trusted device is much easier than typing a card number.

A few things make wallets work better in an agent journey:

• Offer the wallet on the final payment step, not only as an express button on the product page. The agent will usually have built a cart and filled in delivery details first.
• Give wallet buttons clear names. A button an agent can read as "Pay with Apple Pay" tells it what the person will see next. A logo with no name tells it nothing.

Saved cards in a customer account are a different matter. They only help when the person is signed in, and an agent acting for them usually isn't. Treat saved cards as a convenience for people who sign in, not as the way agents will pay.

Delegated and tokenized payments

The next step lets an agent pay without the person stepping in at the moment of purchase, within limits the person sets. Card networks such as Visa and Mastercard, payment providers and protocol groups have each announced their own programs. They're early, and availability, regions and eligibility vary. Here's how the official pages describe them today:

Program	From	How its official page describes it
Visa Intelligent Commerce	Visa	A portfolio for "AI-initiated transactions" that embeds "payment credentials, controls, authentication and protections into automated buying". Visa notes the product is still being deployed and may not include every feature described.
Stripe agentic commerce	Stripe	Integrations for agent builders and sellers, including Shared Payment Tokens, which "grant and receive scoped payment credentials for agent-initiated purchases". Stripe says availability, launch stage and supported countries vary by integration.
Agent Payments Protocol (AP2)	An open protocol, now being standardized at the FIDO Alliance	A way to prove what a person authorized, using "mandates": a Checkout Mandate for the items and purchase details, and a Payment Mandate for the payment. The initial version supports "pull" payment methods like credit and debit cards. The site announces a version 0.2 release.

The idea they share is a token: a stand-in for the person's card that only works within limits, such as a spending cap, a merchant or a time window, and that can be traced back to the person's approval. AP2's documentation calls this "verifiable intent": proof of what the person asked for, so a merchant isn't relying on the agent's word.

• Scoped The credential only works within the limits the person set
• Tokenized A stand-in for the card, not the card number itself
• Provable Linked to a record of what the person approved
• Early Availability, regions and eligibility vary by program

For most stores, none of this is something you build. It reaches you through your payment provider or commerce platform, often bundled with an agentic commerce protocol. Our guide to agentic commerce protocols explains how the checkout side (ACP and UCP) and the payment side (AP2 and the card programs) fit together.

Strong customer authentication and 3-D Secure

Some payments need the person to prove who they are, whoever started the purchase. EMV 3-D Secure, the industry standard EMVCo maintains, is how card issuers authenticate shoppers online to prevent card-not-present fraud. In the European Economic Area, the EU's technical standards for strong customer authentication (Delegated Regulation 2018/389) base it on two or more elements: something the person knows, something they have and something they are.

An agent can't supply those elements for someone, and it shouldn't try. So when a bank asks for authentication, the journey has to come back to the person: a code in their banking app, a fingerprint or a one-time password. In practice:

• Expect the challenge to go to the person. Design the payment step so a bank challenge is something the person completes, not something that silently fails while an agent waits.
• Keep the order alive while they authenticate. If the person takes a minute to open their banking app, the checkout should still be there when they come back.
• Say what happened in text. "Your bank needs to confirm this payment" and "Payment confirmed" are messages an agent can relay. A spinner that never resolves isn't.

What AgentScore checks

AgentScore doesn't test payment itself. The scanner never fills in or submits a form and never pays for anything. It covers the groundwork that decides whether an agent can reach your payment step:

• AI agents aren't blocked or shown a CAPTCHA at the cart and checkout It loads your cart and checkout as a browser and as three AI assistants (ChatGPT-User, Claude-User and Perplexity-User), and compares.
• Shoppers can check out without an account It looks for a guest option, or a checkout that asks for contact and delivery details and no password.
• Agents can check out through an agentic commerce protocol It looks for a Universal Commerce Protocol profile at /.well-known/ucp. Private integrations, such as the Agentic Commerce Protocol, can't be seen from outside.
• Payment and authentication Not tested. The scanner loads the checkout page and goes no further.

If the empty cart and checkout show no form, the scanner presses one product's add-to-cart button and looks again, but it never fills anything in. To test the whole journey up to payment, Ghost Agents in the Ghost Agent Lab app run real AI agents through it with test details you provide. They always stop before paying, and never press a button that places an order or takes payment, including wallet buttons such as Apple Pay.

What to do now

• Test the handoff Build a cart, leave it, and come back later. Is it still there, with the same total?
• Show the full total in text Delivery, tax and discounts before the payment form, not after.
• Offer a wallet on the payment step With a button that has a clear name.
• Make guest checkout available Sign-in should be an option, not a gate.
• Ask your payment provider Which delegated payment programs and protocols it supports, and how it authenticates and scores agent orders.

Questions worth sending your payment provider and platform this month:

1. Which agent payment programs do you support today (for example Visa Intelligent Commerce, Mastercard Agent Pay, Stripe's Shared Payment Tokens or AP2), and in which countries?
2. Is it switched on for us, or do we need to apply or change settings?
3. How are orders paid by agents marked, so our team and our analytics can see them?
4. How do fraud screening, 3-D Secure and chargebacks work for those orders?

Then measure what arrives: our guides to measuring AI agent traffic and tracking visits and sales from AI assistants show whether agent orders are growing.