Announcing Agent Payments Protocol (AP2) | Google Cloud Blog Intro to Google Agent Payments Protocol (AP2)

Google Cloud Unveils Agent Payments Protocol (AP2): A New Paradigm for Secure and Trustworthy Digital Commerce for AI Agents

As the capabilities of AI agents rapidly evolve, they are transforming from simple conversational tools into autonomous entities capable of understanding complex requests and executing multi-step tasks. These agents hold the promise of revolutionizing how we interact with the digital world. For instance, a user could simply describe a desired item to an AI agent, which would then autonomously find, compare, and purchase it, eliminating the need for extensive manual research. However, this transformative prospect also brings fundamental challenges: the existing global payment infrastructure was built for humans, not autonomous AI agents, raising a series of critical questions regarding trust, security, and accountability.

Payment Infrastructure Challenges Posed by the Rise of AI Agents

Traditional payment systems are generally predicated on the assumption that humans directly click "buy" on a trusted interface. However, when AI agents begin initiating payments on behalf of users, this fundamental assumption is disrupted, leading to the following three core issues:

1. Authorization: How can it be clearly proven that a user has explicitly authorized an AI agent to perform a specific purchase? How can transactions be ensured to be user-approved without direct human confirmation?
2. Authenticity: How can merchants be confident that an AI agent's request accurately reflects the user's true intent, rather than an "hallucination" or misunderstanding by the AI model?
3. Accountability: In the event of fraud or incorrect transactions, where should responsibility be assigned? To the user, the merchant, the payment issuer, or the AI model itself?

These questions represent fundamental obstacles to the large-scale adoption of AI agents in digital commerce.

Agent Payments Protocol (AP2): An Open, Secure Solution

To address these challenges, Google announced on September 16, 2025, the launch of the Agent Payments Protocol (AP2). This is an open protocol designed to provide a secure and trustworthy framework for AI agent-led, cross-platform payments, in collaboration with leading payment and technology companies. AP2, developed as an extension of the A2A protocol and the Model Context Protocol (MCP), aims to establish a payment-agnostic framework that enables users, merchants, and payment providers to confidently conduct various types of payment transactions, supporting multiple payment methods including credit cards, debit cards, stablecoins, and real-time bank transfers.

AP2 is built upon the following five core principles:

• Openness and Interoperability: As a non-proprietary, open extension, it encourages competition and innovation, allowing any entity to participate and build services based on the protocol.
• User Control and Privacy by Design: The protocol's design places users at its core, ensuring they always maintain control over transactions. Its role-based architecture ensures sensitive data is shared only with user permission and only when necessary.
• Verifiable Intent, Not Inferred Action: AP2 anchors transactions to cryptographically signed proofs of intent that are certain for all relevant parties, directly addressing the risks posed by agent errors or "hallucinations."
• Clear Transaction Accountability: The protocol creates an irrefutable audit trail for every transaction, providing a clear chain of evidence for dispute resolution.
• Global and Future-Proof: Version 0.1 of AP2 already supports pull payments, with future plans to support push payments, such as real-time bank transfers and digital currencies, to adapt to the evolving landscape of global payments, and eventually support payment authorization scenarios where humans are not present.

Core Operating Mechanism: Mandates, Verifiable Credentials, and Role-Based Architecture

AP2 establishes trust through the use of Mandates, which are tamper-proof, cryptographically signed digital contracts serving as verifiable proof of user instructions. Its operation relies on a role-based architecture and communicates using Verifiable Credentials (VCs). Holt Skinner describes VCs as "tamper-proof, cryptographically signed data payloads," which are credentials created and exchanged by agents, forming the foundational evidence for each transaction.

Example of Role-Based Architecture:

• Shopping Agent: An AI (e.g., Gemini) that interacts directly with the user, responsible for understanding user requests, discovering products, and assembling shopping carts.
• Merchant Endpoint: The merchant-side agent or MCP server, responsible for displaying products and negotiating shopping cart details with the Shopping Agent.
• Credentials Provider: A critical security component, functioning as a secure digital wallet that manages user payment methods, securely processes payment credential data, and selects the optimal payment method for transactions. Notably, the Shopping Agent never accesses raw payment credentials.
• Merchant Payment Processor: The entity that builds the final authorization method for payment networks.
• Networks and Issuers: Play a key role in verifying transactions.

Three Core Credentials of AP2:

1. Cart Mandate:
   • Applicable Scenario: Human present, real-time purchases.
   • Mechanism: When a user asks an AI agent to find and purchase an item, the initial request is captured as an Intent Mandate. After the AI agent presents the shopping cart, the user's approval cryptographically signs a Cart Mandate.
   • Function: It captures the user's final explicit authorization for a specific shopping cart (containing products, prices, and shipping information), creating a secure, immutable record of items and prices, ensuring what you see is what you get.
2. Intent Mandate:
   • Applicable Scenario: Human not present, delegated tasks, to be supported in future versions of AP2.
   • Mechanism: The user pre-signs a detailed Intent Mandate, explicitly stipulating rules of engagement such as price limits, time, and other conditions.
   • Function: It serves as verifiable pre-authorization, allowing the agent to automatically generate a Cart Mandate when precise conditions are met, e.g., "buy these tickets when they go on sale at midnight."
3. Payment Mandate:
   • This is a separate credential for payment networks and banks to understand transaction details. It indicates AI agent involvement and specifies whether the transaction is human-present or human-not-present.

In both scenarios described above, the complete sequence from intent to cart to payment forms an irrefutable audit trail, securely linking the user's payment method to the verified Cart Mandate content. This addresses the critical questions of authorization and authenticity and provides a clear basis for accountability.

AP2 Transaction Flow Diagram

Source: Google Cloud Blog

AP2 Transaction Flow and Commercial Potential

AP2's flexible design not only ensures security through clear transaction flows but also lays the foundation for entirely new business models.

Example of a "Human Present" Transaction Flow:

1. The user makes a purchase request to the Shopping Agent.
2. The Shopping Agent interacts with the Merchant Endpoint to build a shopping cart.
3. The merchant first cryptographically signs the shopping cart, guaranteeing they will fulfill that exact order at that exact price.
4. The Shopping Agent presents the user with the merchant-signed shopping cart and payment options from the Credentials Provider.
5. Once the user approves the transaction, their device signs a Cart Mandate for the merchant and a Payment Mandate for the network.
6. Finally, the transaction is executed, and the user awaits receipt of the goods.

This process creates a clear paper trail. The merchant possesses proof of the user's approved content, which is crucial for assigning responsibility in any dispute.

Innovative Commercial Experiences Unlocked by Intent Mandates:

Through pre-signed Intent Mandates, AP2 transforms transactions into secure, auditable, contract-like conversations, thereby unlocking various innovative business models:

• Smarter shopping: Users can instruct an AI agent: "I really want this green jacket and am willing to pay up to 20% more." The AI agent will continuously monitor prices and availability, and once it finds the specific item that meets the criteria, it will autonomously execute a secure purchase, capturing high-intent sales that might otherwise have been lost.
• Personalized offers: A user tells an AI agent they need a new bicycle for an upcoming trip. The AI agent relays this information (including travel dates) to merchants, whose agents can then create customized, time-sensitive bundle offers, such as a 15% discount package including a bicycle, helmet, and travel rack, converting a simple inquiry into a more valuable sale.
• Coordinated tasks: Users can issue complex instructions to an AI agent, such as: "Book flights and a hotel to Palm Springs for the first weekend of November, with a total budget of $700." The AI agent can interact with airline agents, hotel agents, and online travel agencies and booking platforms. Once a combination that meets the budget is found, it simultaneously executes cryptographically signed bookings.

For example, for a green jacket that is out of stock, an Intent Mandate allows a merchant's agent to check returns, place special orders, and provide new offers, thereby completing a sale that might otherwise have been lost.

Web3 Ecosystem Support

AP2 is designed as a universal protocol to provide security and trust for various payment methods (such as stablecoins and cryptocurrencies) and to accelerate Web3 ecosystem support. Google, in collaboration with Coinbase, Ethereum Foundation, MetaMask, and other leading institutions, has extended the core structure of AP2, introducing the A2A x402 extension. This extension is a production-ready agent crypto payment solution that will help shape the evolution of cryptocurrency integration within the core AP2 protocol.

MetaMask believes that blockchain is the natural payment layer for agents, and AP2 and x402 will enable MetaMask to provide maximum interoperability for developers. Mysten Labs also notes that AP2 combines programmable payments via modern blockchains like Sui with open protocols such as A2A and MCP.

Future Outlook and Community Collaboration

AP2 provides a trustworthy foundation for a new era of AI-driven commerce, establishing the core building blocks for secure transactions. It creates clear opportunities for the entire industry, including networks, issuers, merchants, technology providers, and end-users, to innovate in adjacent areas such as seamless agent authorization and decentralized identity. Google is committed to developing this protocol in an open, collaborative manner, including through standards organizations.

Google's AI Agent Marketplace will continue to offer AP2-supported agents, including new tradable experiences. For example, enterprise companies can use AP2 for B2B applications, such as autonomous procurement of partner-built solutions via Google Cloud Marketplace, or automated scaling of software licenses based on real-time demand.

The complete technical specifications, documentation, and reference implementations are available through Google's public GitHub repository (goo.gold/ap2). Holt Skinner calls for community participation by submitting GitHub issues, proposing pull requests, and engaging in discussions within the repository to collectively build this protocol.

Broad Ecosystem Support

AP2 has garnered widespread support from over 60 industry-leading institutions, including Adyen, Mastercard, and PayPal, underscoring its significant potential in future digital commerce.

Agent Payments Protocol (AP2) Partners

Source: Google Cloud Blog