Stripe and OpenAI's ACP redefines who hits the buy button in your funnel

Stripe and OpenAI have published the specification for the Agentic Commerce Protocol (ACP), an open standard, under the Apache 2.0 license, for AI agents to initiate and complete purchases directly inside interfaces like ChatGPT, without the user needing to leave the conversation and navigate to the seller's website. The documentation is published at agenticcommerce.dev, and the specification's own text is clear about why it exists: "as transactions move from websites to AI workflows, the internet needs a new set of standards for open and secure commerce."

The detail that matters to whoever decides on business strategy, not just to whoever writes the integration, isn't the protocol's REST/MCP architecture. It's the question the protocol resolves behind the scenes: when an agent hits "buy" on behalf of a user, who owns the relationship with that customer, who bears the risk of the transaction, and who controls what appears on the shelf.

How the protocol works under the hood

ACP is compatible with both REST and MCP (Model Context Protocol), which means a company can expose its checkout through either a traditional API or an MCP server, without swapping out the commerce stack it already uses. In practice, the business publishes an "agent-ready" checkout configuration: which products exist, prices, fulfillment conditions. Any agent compatible with the protocol can query this configuration and initiate a checkout.

The critical security point is the sharing of payment credentials. The specification describes this as the secure passing of buyer credentials to the agent "without exposing the underlying payment credentials," in compliance with PCI. Stripe is, according to the protocol's own page, the first compatible processor, via a mechanism called the Shared Payment Token: the payment token circulates between buyer, agent, and business without the agent ever seeing the actual card. This is what allows a third-party AI agent to process a purchase without itself becoming a payment gateway.

A detail that changes the risk calculation for whoever builds the checkout: the specification explicitly guarantees that the company remains the merchant of record (the transaction's legal seller), retaining control over which products can be sold, how they're presented, and how orders are fulfilled. This sets ACP apart from a classic marketplace model, where the platform assumes the seller position. Here, ChatGPT is a discovery and checkout channel, but the contractual and regulatory responsibility on the seller's side stays with the business that implemented the protocol.

The real bet behind the announcement

The official text summarizes the value proposition for three different audiences, and the strategy lies in that split. For businesses: "reach more customers... selling to high-intent buyers through AI agents." For AI platforms: "let your users discover and transact directly with businesses within your application, without being the merchant of record." For payment processors: "grow your volume by processing agentic transactions."

In other words: OpenAI wants the transaction volume and user attention inside ChatGPT, but without inheriting the regulatory and operational liability of becoming a retailer. Stripe wants to remain the payment infrastructure layer even when discovery and closing the sale happen outside its own hosted checkout, something the platform had already been pursuing with products like Stripe Link. And the business that implements ACP gains a high-intent distribution channel, but hands over the interface where the purchase happens, which becomes controlled by the agent's presentation layer instead of its own product page.

It's this handover of interface, more than the protocol's technology itself, that changes the funnel's economics. Today, whoever builds SaaS or e-commerce controls every inch of the journey: how the product is presented, which comparison is made, which upsell shows up at the moment of checkout. In an agent-mediated flow, it's the language model that decides how to summarize the options for the user; in the protocol's own demo example, a request for "a large t-shirt under 40 dollars" returns three competing products side by side, with price as the visible decision criterion. The merchandising that today differentiates conversion becomes, in this scenario, structured data that the agent chooses to highlight or not.

What this changes in CAC and unit economics

The practical implication for anyone who currently measures CAC by the cost of paid traffic or SEO is that ACP creates a third acquisition channel that doesn't follow the same auction rules. The specification makes clear that implementing the protocol doesn't guarantee listing: "each AI platform will manage its own participation process. If your business wants to participate on ChatGPT, you'll need to apply." This recreates, even if only in embryonic form, the app-store curation logic: it's not enough to be technically ready, you need to be approved by the platform that controls distribution.

For unit economics, the medium-term effect is less about processing fees (Stripe hasn't published any pricing change associated with ACP) and more about where funnel value gets captured. If a meaningful share of high-intent purchases starts originating inside ChatGPT, investment in optimizing the checkout page itself loses relative weight against investment in being one of the businesses approved to appear inside the agent, a new distribution bottleneck, today concentrated in a single platform.

The counterpoint that deserves weight

The more skeptical reading is that ACP, for now, is protocol infrastructure without proven demand at scale. Adoption depends on two factors outside the business's control: the user needs to prefer buying inside ChatGPT over going to the website, and OpenAI needs to approve the company's application. The protocol's own page admits that the discovery mechanisms for AI platforms to identify who has implemented ACP are still under construction. This means that, today, implementing the protocol is an optionality bet, not an already-validated sales channel, and the engineering cost of becoming "agent-ready" competes with other roadmap priorities that offer more immediate returns.

Moreover, the fact that the business remains merchant of record is a double-edged sword: retaining control over what's sold also means retaining responsibility for fraud, refunds, and disputes in a transaction it doesn't always initiate directly, a new operational risk that the legal and risk teams need to map before treating ACP as just another checkout channel.

What this means for decision-makers

For founders selling physical products, digital products, or subscriptions in Brazil, ACP still isn't a short-term decision, but it's already a signal of where Stripe and OpenAI are moving the checkout frontier. It's worth tracking three things concretely: whether Stripe Brazil extends the Shared Payment Token to local processors and acquirers, whether OpenAI opens the application process to Brazilian businesses on ChatGPT, and whether other AI platforms (Google, Anthropic, Meta) adopt the same protocol instead of fragmenting the market with proprietary standards. Until then, the cheapest strategic move is to make sure the product catalog is already structured cleanly enough that, once applications open, the technical implementation will be trivial.