Stripe and OpenAI define who controls checkout when the AI agent buys for you

The Agentic Commerce Protocol, published by Stripe and OpenAI in September 2025, doesn't just solve the technical part of the agent that buys: it allocates, by contract, who is the merchant of record, who holds the customer's data, and who processes the payment.

Editor's note: this article originally placed the publication of the Agentic Commerce Protocol in "September 2025." We did not find this date in the official specification (agenticcommerce.dev) or in any other source consulted, and the official site does not list a launch date. We keep the reference because it was the information available at the time of reporting, but the reader should consider it unconfirmed. Likewise, the mention of Pagar.me, Mercado Pago, and PagSeguro (a Brazilian payments company) seeking compatibility with the standard is the editorial team's extrapolation about the Brazilian scenario, not information attributed to the ACP documentation.

The Agentic Commerce Protocol, published by Stripe and OpenAI in September 2025, doesn't just solve the technical part of the agent that buys: it allocates, by contract, who is the merchant of record, who holds the customer's data, and who processes the payment.

The Agentic Commerce Protocol, published by Stripe and OpenAI, doesn't just solve the technical part of the agent that buys: it allocates, by contract, who is the merchant of record, who holds the customer's data, and who processes the payment.

When an AI agent closes a purchase on someone's behalf, three business questions need an answer before any line of code: who is legally responsible for the sale, who holds the customer's data, and who keeps the processing margin. The Agentic Commerce Protocol (ACP), published by Stripe and OpenAI and described in the official specification at agenticcommerce.dev, is the two companies' attempt to answer that before every AI platform creates its own rule.

ACP isn't a product. It's an open standard, under the Apache 2.0 license, that any business or AI platform can implement to take part in "programmatic commerce" flows between buyers, agents, and companies. The documentation is explicit: the protocol is "community-designed," and any compatible PSP (payment service provider) can process it, not just Stripe.

Who Gets What in the Contract

The clause most relevant to those deciding on business, not just architecture, sits in the middle of the page: with ACP, the selling business keeps the status of merchant of record. That means it keeps control over which products can be sold, how they're presented, and how the order is fulfilled, even when the one initiating the purchase is an AI agent.

This detail avoids a scenario that had been worrying retailers since conversational AI became a sales channel: the AI platform becoming the store in practice, with the original supplier reduced to a logistics provider. ACP solves this by separating roles:

• Business (merchant of record): decides what it sells, how it presents it, how it fulfills the order, and keeps the relationship with the customer.
• AI agent: embeds commerce into the user experience, without becoming the legal party responsible for the sale.
• Payment provider: processes the payment token passed between buyer and business through the agent, without exposing the original credential.

The specification calls this avoiding exposure of "underlying payment credentials": the agent never sees the card number, only a secure, PCI-compliant token that Stripe named the Shared Payment Token.

How It Works in Practice: ChatGPT and Stripe First

According to the FAQ published in the documentation, OpenAI is the first AI platform to implement ACP, via ChatGPT, and Stripe is the first compatible PSP, through the Shared Payment Token. That doesn't mean automatic integration: the documentation makes clear that implementing ACP doesn't guarantee listing within the agents.

Any AI agent can call an ACP-enabled checkout. Businesses can then choose to accept or decline transactions on a per agent, per transaction, or custom logic basis.

FAQ, Agentic Commerce Protocol (official site)

In practice, a business that wants to sell inside ChatGPT needs to apply through OpenAI, which runs its own curation process, separate from the protocol's technical side. The standard is open; the distribution channel is not.

REST and MCP: Two Doors, the Same Rule

A technical point with strategic weight: ACP works with both traditional REST API and MCP (Model Context Protocol). The business publishes its checkout configuration in either format, and any compatible agent can initiate it securely.

This matters because it avoids stack lock-in. A team that already exposes its catalog via REST API doesn't need to rewrite everything in MCP just to appear in AI agents; the reverse also holds. The specification promises compatibility with "existing infrastructure," including the payment processor the business already uses, not necessarily Stripe.

The Counterpoint: Open Standard Doesn't Mean Equal Distribution

The thesis that ACP democratizes agentic commerce has a hole that OpenAI itself acknowledges in the documentation: implementing the specification doesn't automatically list the product anywhere. Each AI platform decides its own participation process, and today only one process has been published, OpenAI's for ChatGPT.

This recreates, at another layer, the same problem that marketplaces like Amazon or apps like iFood (Brazil's dominant food delivery platform) already impose on merchants: the rule for accessing the end buyer isn't in the open protocol, it's in the commercial policy of whoever controls the agent. An Apache 2.0 standard reduces the technical cost of integration, but doesn't stop the dominant AI platform from becoming a de facto gatekeeper, charging for placement or prioritizing strategic partners.

Stripe and OpenAI are building the rules of the game together, which raises the obvious question: is a standard designed by whoever dominates conversational AI and whoever dominates payment processing in the West neutral, or is it just open enough to attract adoption before closing the funnel?

What Changes for Those Building Agentic Commerce in Brazil

For those building e-commerce or fintech infrastructure in Brazil, ACP defines a contract worth studying before competing with it. Three practical implications:

1. Merchant of record remains the local business. This protects the Brazilian merchant from becoming an appendage of a foreign AI platform, as long as it implements the specification instead of depending on proprietary integration.
2. Local PSPs can (and should) seek compatibility. Stripe is the first, not the only PSP envisioned; the specification is open to any provider that implements the secure token. Pagar.me, Mercado Pago, and PagSeguro have a window to avoid being left out of the standard that is becoming the reference.
3. Applying for distribution is the real bottleneck. Implementing ACP technically is the easy part; getting approval to appear in ChatGPT, or in the next agent that adopts the protocol, depends on a commercial process that is still being designed, according to the documentation itself.

ACP doesn't create agentic commerce from scratch: it tries to ensure that, when this kind of commerce scales, the selling business doesn't lose its customer relationship or its margin to the AI layer. The open question is who will write the next rule, the one about who gets into the agent's storefront, because that one still isn't in the open protocol.