# The Agentic Commerce Protocol explained for merchants: product feed, checkout and delegated payment

> What the Agentic Commerce Protocol is, who publishes it, what its three specs cover, what is confirmed, and what it means for a Shopify or WooCommerce store.

Canonical: https://convrail.com/blog/agentic-commerce-protocol-explained/

The Agentic Commerce Protocol (ACP) is an open standard, built by Stripe and OpenAI, that lets an AI agent such as ChatGPT show a merchant's products, run a checkout and pass a scoped payment token, while the merchant keeps the order, the payment and the customer. It has three parts: a product feed, a checkout spec and a delegated payment spec.

This guide sticks to what the official sources say, and says so when something is only announced or not documented.

## What the protocol is, in one table

The [official site](https://www.agenticcommerce.dev/) calls ACP "an open standard for programmatic commerce flows between buyers, AI agents, and businesses", states that "Stripe and OpenAI developed the Agentic Commerce Protocol", and that it is "open source and community-designed under the Apache 2.0 license". OpenAI's [commerce documentation](https://developers.openai.com/commerce) describes it as the way to build "commerce flows for ChatGPT, including agentic checkout, delegated payment, and product feeds".

| Part | Who implements it | What it does |
| --- | --- | --- |
| Product feed | The merchant | Shares structured product data so the agent can show the right products |
| Agentic Checkout Spec | The merchant | Five endpoints the agent calls to create, update, complete, cancel and read a checkout session |
| Delegated Payment Spec | The payment provider (or a PCI DSS level 1 merchant with its own vault) | Turns the buyer's payment details into a token limited to one purchase |

The site also lists compatibility with REST and MCP, and support for physical goods, digital products, subscriptions and asynchronous purchases.

## Who does what: the merchant stays in charge

The most important sentence for a store owner is in OpenAI's [key concepts](https://developers.openai.com/commerce/guides/key-concepts): "OpenAI is not the merchant of record in the Agentic Commerce Protocol."

In practice, the split looks like this:

- **The agent (ChatGPT)** collects what the buyer wants and "calls the merchant's Agentic Commerce Protocol endpoints to create or update a checkout session". The checkout is drawn in ChatGPT's interface.
- **The merchant** "performs validation, determines fulfillment options, calculates and charges sales tax" and "determines whether to accept or decline the order". The checkout state and the payment processing live on the merchant's systems.
- **The payment provider** receives a one-time delegated payment request and returns a token the merchant charges through its normal flow.

So the protocol does not move the store into ChatGPT. It lets ChatGPT drive the store's own checkout from the outside, with the store keeping its pricing, tax, stock, fraud checks and fulfillment.

## Part 1: the product feed

OpenAI's documentation is explicit about where to begin: "Start your ACP integration by sharing a structured product feed." The feed is how the agent knows what you sell, at what price and whether it is in stock. Merchants share it "so ChatGPT can accurately surface their products in search and shopping experiences", with required fields for display and recommended attributes that improve ranking and trust.

The feed can be sent by file upload or by API. The rules are strict and a row that breaks them is not shown: the [OpenAI product feed specification, explained field by field](/blog/openai-product-feed-spec-explained/) walks through every required field and the formats that get rows refused, and [Parquet vs JSONL vs CSV](/blog/parquet-vs-jsonl-vs-csv-openai-feed/) covers the file formats.

This part matters even if you never build checkout. The same structured data feeds product discovery in ChatGPT, which is why a clean feed is the first step for any store that wants to be found there.

## Part 2: the Agentic Checkout Spec

The [Agentic Checkout Spec](https://developers.openai.com/commerce/specs/checkout) has one stated goal: "Enable merchants to run end-to-end checkout flows inside ChatGPT while keeping orders, payments, and compliance on their existing commerce stack."

The merchant hosts five REST endpoints:

| Endpoint | Purpose |
| --- | --- |
| `POST /checkout_sessions` | Create a session from the cart |
| `POST /checkout_sessions/{id}` | Update it when the buyer changes address, shipping or items |
| `POST /checkout_sessions/{id}/complete` | Complete the purchase with the payment method |
| `POST /checkout_sessions/{id}/cancel` | Cancel the session |
| `GET /checkout_sessions/{id}` | Read the current state |

Every response must return "a rich cart state (items, pricing, taxes/fees, shipping, discounts, totals, status)". After the order, the merchant publishes lifecycle events such as `order.created` and `order.updated` to a webhook "so ChatGPT stays in sync with fulfillment-grade truth".

Payment stays with your existing provider: "You process payment with your existing PSP; if using Delegated Payments, accept the token and apply your normal authorization/capture flow."

## Part 3: the Delegated Payment Spec

The [Delegated Payment Spec](https://developers.openai.com/commerce/specs/payment) is written for "PSPs or PCI DSS level 1 merchants using their own vaults". The provider receives the payment details and "returns a payment token scoped to the delegated payment outside of PCI scope". The token is single use and bounded by an allowance:

- a **maximum amount** the payment method can be charged for,
- an **expiry** time,
- a **merchant scope**, which ties the token to one merchant.

The design principle, in OpenAI's words: credentials "are narrowly scoped and cannot be used outside the defined limits of the user-approved purchase."

Stripe is the first compatible provider, with its Shared Payment Token. OpenAI also warns that integrating the spec directly "involves directly handling cardholder data (CHD) and may affect your PCI scope", which is why most stores will rely on their provider rather than implement it themselves.

## One purchase, step by step

Putting the three specs together, a single purchase through the protocol follows this sequence, as described in OpenAI's documentation:

1. **Discovery.** The buyer asks ChatGPT for a product. ChatGPT reads the merchant's product feed to know what exists, at what price and whether it is in stock.
2. **Session creation.** When the buyer chooses to buy, ChatGPT calls `POST /checkout_sessions` on the merchant's server with the item. The merchant answers with the full cart state: price, taxes, shipping options, totals.
3. **Updates.** If the buyer adds an address or picks a shipping option, ChatGPT calls the update endpoint and the merchant recomputes the totals. The merchant, not ChatGPT, decides prices, taxes and what can be shipped where.
4. **Payment delegation.** OpenAI prepares a one-time delegated payment request with defined limits and sends it to the merchant's payment provider, which returns a token scoped to that purchase.
5. **Completion.** ChatGPT calls the complete endpoint with the token. The merchant charges it through its normal authorization and capture flow, runs its usual risk checks, and accepts or declines the order.
6. **Order sync.** The merchant sends `order.created`, then `order.updated` events to the provided webhook, so ChatGPT shows the buyer an accurate status.

Two practical consequences follow. First, everything that makes an order valid in your store (stock, tax rules, shipping zones, fraud checks) keeps working, because the protocol calls your systems instead of replacing them. Second, the order lands in your own back office like any other, which means your existing accounting, fulfillment and customer service flows still apply.

What the sequence does not include is the reverse path for an ad: a sponsored placement is bought in ChatGPT Ads Manager and measured with the pixel and the Conversions API, which are separate from ACP. The [ChatGPT Ads guide](/blog/how-to-advertise-on-chatgpt/) covers that side.

## What is confirmed today, and what is not

Here is the state of things from official sources, with the uncertain parts flagged.

- **Announced:** in September 2025, OpenAI presented [Instant Checkout](https://openai.com/index/buy-it-in-chatgpt/) in ChatGPT, powered by ACP and built with Stripe. The announcement covered US users buying from US Etsy sellers, single-item purchases first, and Shopify merchants "coming soon".
- **Documented for builders:** the specs above, and a [production guide](https://developers.openai.com/commerce/guides/production) listing what must be tested in a sandbox before going live (session creation, shipping updates, delegated tokens, `201 Created` on completion, signed webhooks, error cases, idempotency), plus TLS 1.2 or later and allowlisting OpenAI's IP addresses. OpenAI "may require your attestation of compliance (AOC) before enabling production access."
- **Not documented in the pages we read:** merchant eligibility criteria, the application process and any fee schedule. Do not plan around numbers you have only seen in press coverage.
- **For Shopify stores specifically:** Shopify's [help center](https://help.shopify.com/en/manual/online-sales-channels/agentic-storefronts/chatgpt) describes ChatGPT purchases completing on the store's own checkout, in ChatGPT's in-app browser or a new tab. Check that page before assuming in-chat payment is available for your store.

## What it means for a Shopify or WooCommerce store

| Your situation | What to do now |
| --- | --- |
| Shopify store | Eligible products reach ChatGPT through Shopify Catalog; work on product data quality and measurement rather than building endpoints. See [selling on ChatGPT with Shopify](/blog/sell-on-chatgpt-shopify/). |
| WooCommerce store | Start with a valid OpenAI product feed and conversion tracking; building the checkout endpoints is a custom development project. See [selling on ChatGPT with WooCommerce](/blog/sell-on-chatgpt-woocommerce/). |
| Custom commerce stack | ACP is written for you: feed first, then the five checkout endpoints, with your payment provider handling delegated tokens. |

Whatever the path, two things stay your job: the quality of the product data the agent reads, and knowing which orders ChatGPT actually brought you.

## What the protocol does not measure for you

ACP moves an order from an agent to your systems. It does not tell you how often ChatGPT shows your products, which orders came from an ad rather than organic discovery, or whether those orders made money after ad spend. Those questions sit outside the protocol:

- **Is my feed accepted?** Every refused row is invisible to the agent. Convrail validates each product against the OpenAI specification before delivery and shows the exact fix on its [product feed page](/product-feed/).
- **Which orders came from ChatGPT?** [Attribution](/attribution/) matches every paid order to ChatGPT Ads or organic ChatGPT, using your store's own data.
- **Does ChatGPT recommend my store?** [AI search visibility](/ai-visibility/) tracks the buying questions your shoppers ask, every week.

## Three common misreadings

| Misreading | What the official documentation says |
| --- | --- |
| "OpenAI sells my products and pays me later" | OpenAI is not the merchant of record; you charge the buyer through your own payment provider |
| "ChatGPT gets my customers' card numbers" | The agent passes a single-use token, capped in amount and time and bound to one merchant |
| "The protocol replaces my product feed" | The feed is the documented first step of an integration, not an alternative to it |

Each of these matters for a store's decisions. The first one means your margins, refunds and customer service stay as they are. The second one means you do not need to store new payment data. The third one means a clean, validated feed is useful whatever you decide about checkout.

## Key takeaways

1. ACP is an open standard from Stripe and OpenAI, under Apache 2.0, with three parts: feed, checkout, delegated payment.
2. OpenAI is not the merchant of record: the store keeps the order, the payment and the customer.
3. The documented first step is a structured product feed, and it pays off even without checkout.
4. Payment tokens are single use, capped in amount, time limited and bound to one merchant.
5. Eligibility and fees are not documented in the pages we read: verify current status on OpenAI's and Shopify's pages before building.