A new channel of commerce, agentic commerce, is on the scene. It is definitely the hot topic. For a merchant the main question is how to make sure that the agent finds their e-commerce store or products and, if payment has been fully delegated to the agent, how exactly to accept it. Mastercard provides the options for both. If you have questions about how to participate safely and easily in Mastercard agentic payments, what exactly to do, and how to do it, this report and guide from Belitsoft is for you.
An AI agent can find out about your products in 4 ways.
According to Mastercard, an agent can use your website like a human: open your pages, fill in your forms and complete your checkout.
Some of the agents on your website are registered with payment networks such as Mastercard, Visa and American Express. These agents are certified only after a security review. So you don’t have to do anything for this certification: the payment network checks the agent for you. Agents without this registration also shop on your website, and Mastercard tells you to check their payments like any online card payment.
Some of these agents are from AI platforms, such as ChatGPT in agent mode. Other agents without registration are open-source tools that people use when they shop with you: Mastercard calls them consumer-owned agents.
When you block bots on your website, you can block these agents as well. Mastercard says you should not block agents only because they lack scheme registration, that is, they are not registered with a payment network and so not certified: consumers use these agents to shop. If you block consumer-owned agents across the board, you’ll lose customers to competitors.
So Mastercard suggests a tiered trust strategy for all the agents on your website, certified or not. With this strategy you keep your product pages, search and categories open to all agents: according to Mastercard an agent that you block on these pages will never recommend your products. Then you add checks at checkout for the agents that are not certified, like a sign-in or purchase limits.
For this strategy, Mastercard splits the agents on your website into five levels of trust and calls this the trust spectrum. Level one is certified agents, and you give them full access and a simple checkout with fewer steps. However, your fraud protections stay active for these agents too.
Level two is agents that AI platforms like ChatGPT send to your website, and Mastercard calls them platform-identified. You can identify them by the User-Agent header or by Web Bot Auth, and most websites use this header to spot automated traffic. This header is easy to fake, so a signature tells you more, says Mastercard: with Web Bot Auth, an agent signs each request to your website. Platform-identified agents have standard access, and you keep the normal checkout with payment authentication.
Level three is consumer-owned agents that tell you who they are, for example with Web Bot Auth. For these agents, Mastercard recommends open discovery: they can look at your products, and you keep the checks that you have at checkout and monitor their behavior.
Level four is agents that don’t tell you who they are, and Mastercard calls them anonymous. Such an agent can be a legitimate agent of a consumer or a malicious bot: an agent that a person uses to shop with you, or a bot that scrapes your website. Such an agent sends you no identity signals, so you can’t tell the two apart.
These agents can also look at your products, but you add more checks at checkout, use rate limiting and analyze their behavior. Such a limit can be 100 requests per minute for agents, as in a Mastercard example. According to Mastercard, rate limiting stops abuse and lets legitimate agents shop. Then level five is bots whose bad behavior you have identified: Mastercard calls them malicious, and they don’t follow your rate limits or your terms of service. These are the ones you block and report. However, Mastercard doesn’t say who you report them to.
Mastercard also recommends that you set up Web Bot Auth on your website. Web Bot Auth signatures show you which agents say who they are and which ones stay anonymous. Also, Mastercard says you should track agents as a separate channel in your analytics, so you see where in your checkout agents fail.
Once agents can see your pages, put the product name and the price in the page as soon as the page loads, not added later by JavaScript. That’s what agents expect, and according to Mastercard they may not wait for a complex script to load. Also, the availability and the fields at checkout need to be in the page when the page loads. Then test two or three important paths on your website, like buying your most popular product or making a return. That way you can see where an agent could have problems.
For ChatGPT, you upload your product data to OpenAI, and ChatGPT will show your products to your customer. How visible your products are in ChatGPT depends on the quality of this data. You upload this data with the Agentic Commerce Protocol (ACP), an open standard that OpenAI and Stripe developed together.
According to Mastercard, what you pay for in ChatGPT is traffic and discovery, and you don’t pay for each sale. Mastercard doesn’t say how much you will have to pay. If you want to take part in ChatGPT shopping, you can talk to Mastercard, and the company will tell you more. Your customer doesn’t pay inside ChatGPT anymore: in March 2026 OpenAI shut down Instant Checkout, the option to buy in the chat. However, OpenAI’s guide for developers, which has no date, describes what you implement as a merchant to support Instant Checkout in ChatGPT. Now your customer is sent to your website or your app to complete the checkout and the payment. As for ChatGPT, our report on Stripe covers this way to find your products.
According to Mastercard, you have to set up your products in Google Merchant Center with the native_commerce attribute. After that, people can find your products in Gemini Shopping and in Google Search AI Mode. In Gemini Shopping, how well your products are shown depends on your product data, not on paid advertising.
Also, people can pay for your products in both places, but for that you have to implement Google’s Universal Commerce Protocol (UCP) on your website. UCP is an open-source standard for agentic commerce from Google. According to Mastercard, you can use this payment option if you are an eligible merchant in the US. Mastercard’s guide doesn’t tell you who is eligible. Also, Google’s announcement for retailers only says that shoppers can check out from eligible US retailers.
However, Google said on May 20, 2026 that this checkout will roll out in Canada and Australia in the next few months, and later in the UK. As of October 14, 2026, Google has posted nothing newer about Canada, Australia and the UK.
Mastercard announced Agent Connect on September 9, 2026. Mastercard promises that you will only need a single integration with AI agents and payment service providers (PSPs), and the agents that participate in Agent Connect will be able to find your products. In Agent Connect, you choose which AI experiences you connect to.
If you want to join, you can speak with the Mastercard team, says the Mastercard page for merchants that includes Agent Connect. Mastercard doesn’t say when Agent Connect will be available or whether you will have to pay for this service. According to Mastercard, technology companies and platforms such as Getnet, Global Payments, Nexi, Samsung and Trip.com expect to work with Agent Connect, beginning in the United States. Mastercard also promises onboarding options without code for eligible merchants, but doesn’t tell you which merchants are eligible.
An agent certified by Mastercard pays you with Mastercard Agent Pay. Agent Pay is Mastercard’s agentic payments program, which lets certified agents make secure purchases for your customers. According to Mastercard, the agents in Agent Connect will also pay you with Agent Pay. In Agent Pay, the agent pays you with a token instead of a card number.
The agent platform asks the payment network for this token, and the agent enters the token in the usual fields on your checkout form. After that, your payment gateway receives the token. Your gateway then exchanges this token with the payment network for the card data. So you don’t have to change anything in your payment processing.
So can your customer buy from you with an agent today? Yes, if your customer is “present through the agent,” says Mastercard’s Brice van de Walle. Your customer tells the agent what to buy at the time of the purchase. A purchase where “the consumer is no longer present” is what van de Walle calls “the future.” However, with a customer who is present, a “single merchant, single product” purchase is possible now: “Right now, we can already cater for that,” claims van de Walle. He also says that a purchase with several merchants and a customer who is present is “something which we believe can be managed already today.”
With Agent Pay, only registered agents can transact on the network, says Mastercard. So you need to know whether the agent at your checkout is certified. You know this from the Web Bot Auth signature that the agent sends with each request. The tag in this signature shows you which payment network certified the agent. When you check the signature, you check the agent against a trusted agent registry: a payment network like Mastercard adds each certified agent to this registry.
You can check this signature in your backend or with your edge provider, a company like Cloudflare, Akamai or Fastly. Mastercard recommends the edge provider: ask this company how to set this up.
If the signature is valid, you look at the tag. The tag is Agent-pay-auth if Mastercard certified the agent. If Visa certified the agent, you see the tag agent-browser-auth for browsing and agent-payer-auth at checkout. Other agents that support Web Bot Auth have a generic tag, web-bot-auth: ChatGPT in agent mode is one of these agents. According to Mastercard, you should check for the tags of the payment networks and for the generic tag.
However, Mastercard says that not all legitimate agents have this signature yet. Without the signature, you can identify some legitimate agents by their User-Agent header or by their behavior before they adopt Web Bot Auth. Mastercard calls these signs known agent patterns: you give them less trust than a verified signature. However, a User-Agent header alone doesn’t prove who the agent is: Mastercard warns that this header is easily spoofed. Mastercard tells you to relax your checks step by step as these agents show more signs of trust and to watch how they behave.
If a request has no valid signature and shows no known agent pattern, you apply the rules that you have for bots. In this case you have three choices: block, challenge, or allow and keep a log. However, Mastercard also tells you not to turn agents away just because they lack scheme registration.
An agent that shops on your website like a human has to fill in your checkout form. If the form is hard to read, the agent can fill in the wrong fields or give up on your checkout. According to Mastercard, an agent reads the names of the fields, the labels, the input types and the autocomplete attributes. So you check that every field has a name that tells agents which data to enter, the correct input type and an autocomplete attribute.
Also, you need to link the label to the field in the code. These fields should use the native input, select and textarea elements instead of your custom components. That’s because agents can’t work with non-standard elements. These points are in a Mastercard checklist for forms: use this checklist to verify that your forms are ready for agents, says Mastercard.
Mastercard says that CAPTCHAs are bot checks made to stop scrapers, so you should avoid aggressive CAPTCHAs that stop legitimate agents and use rate limiting instead of blocking all the bots.
At checkout, an agent can also be stopped by 3-D Secure. 3-D Secure is an extra step in an online card payment: the bank asks your customer to approve the payment. This step starts on your website, and an agent usually can’t approve the payment for your customer, so the step fails.
However, a certified agent verifies your customer before the purchase: Mastercard says that this check is the job of agent providers. So your systems don’t need additional authentication logic to check your customer. However, Mastercard says that you have to adapt your 3-D Secure to the limited support for payments by agents today.
So you check the Web Bot Auth signature to see if a certified agent sent the request, says Mastercard. If you see that a certified agent sent the request, you can skip 3-D Secure. You can also leave 3-D Secure on. If the step fails, you don’t want to count the failed step as fraud or block the payment of a certified agent just because 3-D Secure failed.
According to Mastercard, the payment networks are working on 3-D Secure support for payments by agents, so you should watch for the announcements of Mastercard, Visa and American Express.
For agents that are not certified, you use the security checks of any online card payment: 3-D Secure and checks on the address and the card security code (CVV). Also, match extra checks to the risk of each purchase, says Mastercard: rate limiting, a required sign-in to an account, a confirmation by email or by text message (SMS) and purchase limits. Mastercard’s guide for merchants on agentic commerce has a table of 3-D Secure cases for payments by agents, and this table doesn’t mention certification. If you start 3-D Secure and the payment then proceeds without authentication, the table tells you not to count this as a sign of fraud.
Mastercard also describes merchant validation: an agent can check that you are the seller and not a copy of your website. For now, this check is in development, and you can sell to agents without this validation. However, Mastercard recommends that you set up merchant validation. Mastercard’s guide describes the benefit in two ways: in one table, certified agents are expected to recommend validated sellers first, and in another table certified agents buy only from validated sellers.
Merchant validation of your business starts with a registration, and according to the page The Rails for Agentic Commerce you should be registered to take part in Mastercard Agent Pay as a merchant. So who registers you? According to Mastercard, your acquirer or your payment service provider (PSP) usually does that for you. So you should contact your PSP or your acquirer: ask if they are ready for agents and ask them to register your business. Your PSP will need your merchant identifiers, your website addresses and your business details. Also, ask who manages the signing keys, the keys that prove your identity to agents: your PSP or you.
After the agent pays you, who takes the loss if the agent bought the wrong product? That’s a question Mastercard is working on. In January 2026, Mastercard said that the company was answering this question by building standards for agentic commerce with partners, including the AI platforms. Fortune asked Ed McLaughlin, Mastercard’s President and Chief Technology Officer, in an interview published in September 2026: “The liability falls on whom?” McLaughlin did not name anyone. He had just made a promise to your customers and to you: “you have zero liability if you have a valid transaction on our network, you have full recourse, and likewise to a merchant that we will stand behind that payment commitment.” He did not tell you whether a purchase with a mistake by the agent counts as a “valid transaction.”
However, in an interview with Jill Willard, the chief technology officer of IXOPAY, you can hear one answer about Mastercard and Visa. IXOPAY sells payment tools to merchants like you, and in this interview one speaker, whom the transcript doesn’t name, says: “Mashcard, Visa, others are saying no, it's on the merchant, it's on the merchant acquirer.” “Mashcard” here means Mastercard, and the merchant is you.
However, American Express has announced a program for these mistakes, Amex Agent Purchase Protection. American Express tells you that this program is an intention for the future. The company intends to protect eligible Card Members and merchants from charges after a mistake by an agent that is registered with American Express. So far the terms that American Express has published tell your customer to start a return with you first if a return is possible. These terms cover credit cards from the United States. However, Mastercard’s guide describes this program as cover for cardmembers against losses from mistakes by registered AI agents.
So what rules apply to you today? According to Mastercard the standard chargeback rights and dispute processes apply when an agent buys from you: your customer keeps the right to dispute the payment, and you can’t ask your customer to give up this right for what an agent bought. However, Mastercard says that you should expect new rules: the payment networks are developing dispute rules for purchases by agents.
When you receive a dispute, you first find out if an agent made the purchase. For agent purchases, Mastercard says you should prepare your dispute processes for new kinds of disputes and names the evidence for each kind.
If the agent misunderstood your customer and bought the wrong product, your evidence is what the agent searched, viewed and selected. If the agent made a mistake such as the wrong quantity, you show the cart at each step. If your customer says that a malicious agent made the purchase, you prove that you checked the Web Bot Auth signature and the certification of the agent. If your customer doesn’t remember the purchase, you need the logs of the agent’s session and the time when your customer confirmed the purchase. Each time, you have to prove that the payment was authorized and that the agent acted within the limits that your customer set.
That’s why Mastercard tells you to store the context of each purchase by an agent at the time of the sale, and calls this context your primary evidence. This context holds the evidence for each kind of dispute, and also which agent bought from you and who your customer was.
In a dispute, Mastercard wants your support team to see five points. These are the order, the agent session and the identity of your customer. The other two are the intent exchange and the signature data as proof of the authorization by the agent and by your customer. The intent exchange is what your customer asked for and confirmed, and you can find this point in the context that you store today. Also, Mastercard has a code example for developers for this storage.
Also, the intent, what your customer allowed the agent to do, travels with the payment, according to a speaker in the interview with IXOPAY. However, today the networks “don't actually let you see the intent object when they pass it through,” says a speaker in this interview. Mastercard says that the payment networks are building systems to share this intent data with you and that you will receive this data as part of the transaction later. Intent data that you receive straight from the agent is also part of the future, says Mastercard.
Verifiable Intent, a protocol from Mastercard and Google, adds a tamper-resistant record to the intent data of your customer. This record links your customer’s verified identity, the agent’s instructions and the result of the purchase with cryptographic signatures.
According to Mastercard’s guide, this protocol is in use or in a late stage of standardization at version 0.1. In September 2026, Mastercard said that Agent Pay uses Verifiable Intent to help confirm that purchases have the authorization of your customer. When an agent sends you a checkout with Verifiable Intent signatures, you can store this intent as evidence for disputes, says the guide. According to the guide, such a record is much stronger evidence than ordinary transaction logs in disputes about a wrong product, and the guide tells you to consider adding Verifiable Intent records to the context that you store when more companies adopt the protocol.
Rate this article
.jpg)
.jpg)
We have been working for over 10 years and they have become our long-term technology partner. Any software development, programming, or design needs we have had, Belitsoft company has always been able to handle this for us.
Belitsoft has been the driving force behind several of our software development projects within the last few years. This company demonstrates high professionalism in their work approach. They have continuously proved to be ready to go the extra mile. We are very happy with Belitsoft, and in a position to strongly recommend them for software development and support as a most reliable and fully transparent partner focused on long term business relationships.
It was a great pleasure working with Belitsoft. Software Development Company. New requirements and adjustments were implemented fast and precisely. We can recommend Belitsoft and are looking forward to start a follow-up project.
They use their knowledge and skills to program the product, and then completed a series of quality assurance tests. We were working in an agile way with them. Belitsoft performed very well throughout our project. We are definitely looking at Belitsoft as a long-term partner.
I highly recommend Belitsoft for website design and development. We were up against a tight deadline to launch the project. The work was delivered on time and within budget! I will continue working with Belitsoft as a valued partner for our web development!
We have worked with Belitsoft team over the past few years on projects involving much customized programming work. They are knowledgeable and are able to complete tasks on schedule, meeting our technical requirements. We would recommend them to anyone who is in need of custom programming work.
Belitsoft company is able to make changes instantly. One of our internal engineers has commented about how clean their code is. Belitsoft seems to know what they're doing, which I appreciate.
Belitsoft company has been able to provide senior developers with the skills to support back end, native mobile and web applications. We continue today to augment our existing staff with great developers from Belitsoft.
Belitsoft company delivered dedicated development team for our products and technical specialists for our clients time to time custom development needs. We highly recommend that you use this company if you want the same benefits.
We approached BelITsoft with a concept, and they were able to convert it into a multi-platform software solution. Their team members are skilled, agile and attached to their work, all of which paid dividends as our software grew in complexity.
Having worked with Belitsoft as a service provider, I must say that I'm very pleased with the company's policy. Belitsoft guarantees first-class service through efficient management, great expertise, and a systematic approach to business. I would strongly recommend Belitsoft's services to anyone wanting to get the right IT products in the right place at the right time.
If you are looking for a true partnership Belitsoft company might be the best choice for you. They have proven to be most reliable, polite and professional. The team managed to adapt to changing requirements and to provide me with best solutions. I strongly recommend Belisoft.
I expected and demanded a lot of you at Belitsoft company, but you exceeded my expectations. You acted pro-actively, challenged me at the right moments. Thanks!
![Stripe Agentic Payments: Belitsoft's Report [October 2026]](/uploads/images/blogposts/financial-technology-trends-news/agentic-payments/stripe/stripe-agentic-payments-image(600x250-crop).jpg)