Agentic payments explained: how an AI agent actually pays

What agentic payments are

A normal online payment assumes a person at a screen: they choose, type or tap a card, and confirm with a code or a fingerprint. In an agentic payment, software does the choosing and the paying. The person stays in charge by setting the rules in advance: what the agent may buy, from whom, up to how much, and when it must ask first.

The industry calls the wider field agentic commerce, which covers searching and comparing as well as paying. This article is about the payment itself, the part where money moves.

The five steps of an agent payment

1. The mandate: the person sets the limits

Before an agent pays for anything, someone has to say what it is allowed to do. Google's Agent Payments Protocol (AP2) makes this explicit: an "intent mandate" records the person's instruction, signed so it can be checked later.⁴ Retailers are adding their own limits. Walmart lets shoppers cap an agent at $50, $100 or $200.⁷

UK law firm Pinsent Masons expects regulation to settle on a two-stage model: the person authorises the agent's limits once, for example £100 a month, and each payment is then checked against them.⁸

2. The credential: a token, not a card number

Handing an AI agent your card number would be the weakest possible design. Instead, the card networks and payment companies issue the agent its own credential:

• Visa Intelligent Commerce tokenises the person's card into the agent, with the card authenticated by passkey.¹
• Mastercard Agent Pay issues "agentic tokens" built on its existing tokenisation.²
• Stripe's shared payment tokens, used in the Agentic Commerce Protocol, are limited to one merchant and one basket total.³ In 2026 Stripe added single-use cards issued to agents.⁹

Walmart's terms for agents go furthest: agents never receive card data at all.⁷ The narrower the token, the less damage a leak or a mistake can do.

3. Identity: the merchant checks the agent is real

To a website, a shopping agent and a malicious bot look alike. Visa's Trusted Agent Protocol, developed with Cloudflare, has approved agents sign each request using a web standard for signed messages (HTTP Message Signatures, RFC 9421), so a merchant can verify which agent is calling and for whom.¹⁰ Other "Know Your Agent" schemes do similar jobs, and no single one has become the standard.⁵ Merchants that cannot verify an agent increasingly block it.⁷

4. Authorisation: the basket and the payment

When the agent is ready to buy, two more things are confirmed: what is in the basket and what will be paid. In AP2 these are separate signed records, a "cart mandate" and a "payment mandate", alongside the original intent mandate.⁴

Then the payment has to satisfy strong customer authentication, which UK and EU rules require for most online payments. Those rules assume a person can supply a second factor, which an agent cannot.⁸ The fix in practice is passkeys: Visa secured its live European agent payments with Visa Payment Passkeys, which it says support the European authentication rules.⁶ Version 0.2 of AP2 adds payments where the person is not present at the moment of purchase.¹¹

5. The record: proof of what was asked and what was bought

If a payment is disputed, someone has to show what the person instructed and what the agent did. AP2's chain of signed mandates is one answer.⁴ Mastercard says its Verifiable Intent record, developed with Google, links the person's identity, their instruction and the outcome.¹² Who carries the loss when the record shows the agent got it wrong is still unsettled.⁵

Three ways the money moves

Most of the live agent payments reported so far run on cards, including Visa's European transactions in July 2026.⁶ Stablecoin payments between agents get attention, but daily volume on x402 fell from about $800,000 in January 2026 to about $40,000 in September.¹⁵

Who builds which part

Common questions

Can an agent spend more than I allow?

The systems are designed so it cannot: the mandate sets the limit, the token is scoped to it, and the payment is checked against both. How well that holds depends on the agent and the services it uses, and attacks that trick agents are a known risk. Palo Alto Networks' Unit 42 has shown hidden text on a web page making an agent add a gift card to its basket.¹⁷

What happens if the agent buys the wrong thing?

Normal returns and disputes still apply, and Walmart says its returns process covers cases where an agent does not act as expected.⁷ American Express has announced, but not launched, protection for errors by registered agents.¹⁸ Beyond that, the law is unsettled.^{5, 8}

Is this available in the UK?

Yes, in early form. Barclays, HSBC UK, Lloyds Banking Group, Nationwide, NatWest and Vanquis were among the issuers that completed live agent payments on Visa in July 2026, and the FCA is running a sandbox for agentic payments to the end of 2026.^{6, 19}

For where this is heading, read the future of agentic transactions. This site's own domain, agentictransactions.ai, is for sale by open auction. See the live auction.