The Early Building Blocks of Agentic Commerce

Six months ago, Visa demoed a bold vision for the future of AI-assisted purchasing. Their announcement included a video showing consumers using an AI assistant with the catchy slogan “Visa Intelligent Commerce: allowing AI to shop and buy.” Visa also introduced functionality that lets cardholders expose their spending preferences and limits to agents, enabling more intelligent purchasing without losing control.

It’s now looking like Stripe and OpenAI have taken a tangible step toward actualizing that vision. Stripe announced two foundational tools earlier this month: the Shared Payment Token and the Agentic Commerce Protocol. At the same time, OpenAI announced that consumers can now use ChatGPT to purchase items from Shopify and Etsy stores—presumably powered by these new Stripe capabilities.

Shared Payment Tokens & Usage Limits

Stripe's Shared Payment Tokens (SPTs) are a new kind of payment credential. They allow developers to tightly control how a token can be used, including:

• How long it's valid

• How much it can spend

• Which merchants can accept it

These controls feel promising, but we’re still unclear on who sets them. While Visa emphasized direct cardholder input, Stripe’s documentation seems to suggest the agent (e.g. ChatGPT) may be the one setting usage limits. If that’s the case, the potential exists for new security concerns like prompt poisoning. If you’re still learning the AI lingo, that’s an important one; “prompt poisoning” encompasses a particular brand of AI misuse where someone intentionally tricks an agent into doing the wrong thing—like loosening or misinterpreting budget constraints, for example.

At this time, we’re not clear on another important aspect of SPTs: how do these usage controls behave when an SPT is forwarded to a merchant who isn’t processing payments through Stripe? Stripe claims they’ll work, but the details of how aren’t yet explicitly outlined.

Agentic Commerce Protocol

Alongside SPTs, Stripe and OpenAI have also launched the Agentic Commerce Protocol (ACP). In their blog, Stripe defined ACP as “a new open standard…that enables programmatic commerce flows between buyers, AI agents, and businesses.” The stated goal with ACP is to help merchants quickly and easily accommodate agent-led checkouts. If customer demand for agentic commerce takes off the way bloggers will lead you to believe, such simplicity will be key to satisfying modern shoppers.

As is, the current implementation only supports Stripe as a payment processor. While this limitation makes sense given ACP’s nascency, it’s still likely to pose an adoption issue. Merchants who aren’t operating on Shopify and Etsy, or those who simply don’t process through Stripe, won’t have access to ACP integrations at all.

The product discovery side of the protocol also has limitations. OpenAI’s Product Feed is technically open, but for your wares to appear available for agentic purchase, you need approval from OpenAI. Such approval is currently limited to a small set of platforms.

Navigating Walled Gardens

Agentic commerce might be here, but access is certainly gated. OpenAI has to give you the ol’ thumbs up before your products even appear in an AI agent’s feed and agents can’t go through checkout unless you process with Stripe. Again, we know this is just v1, but these requirements give a handful of gatekeepers real power in deciding who gets to participate in the next (potentially) big commerce shift.

Until these limits change, we expect adoption of agentic commerce to be lopsided. Early implementations will favor merchants already embedded in OpenAI’s world (e.g. those on Shopify); individual merchants and those with non-Stripe PSPs may be left waiting in the cold.

What Merchants Should Watch For

Even at this early stage, agentic commerce introduces new behaviors and questions merchants should be thinking about:

• Decline handling: What happens when an AI agent exceeds its budget? Will merchants see new decline codes?

• PCI compliance: OpenAI’s documentation suggests some merchants may receive full card numbers (FPANs), which has significant implications for PCI scope.

• Token interoperability: If Shared Payment Tokens are forwarded, how should merchants validate and respect usage limits?

• Chargeback responsibility: If an agent orders the wrong thing or misleads the buyer, are the resulting chargebacks on you, the consumer, or the LLM that made the decision?

A Tentatively Promising Start

Stripe and OpenAI’s releases represent the first practical steps toward making agentic commerce a reality. The infrastructure is early and limited, but the foundation is promising.

For now, agentic commerce favors Stripe-connected merchants and select partners. But if the protocols and tools expand meaningfully, they could unlock new purchase paths for consumers and new sales opportunities for merchants.

We’ll be watching closely as the space evolves—and helping merchants navigate whatever comes next.