Agent Payments Protocol (AP2)

What AP2 is

Google announced the Agent Payments Protocol, or AP2, on 17 September 2025. It is an open protocol developed with payments and technology companies to securely initiate and transact agent-led payments across platforms ^[1]. In plain terms, it is a shared set of rules for the case where an AI agent, rather than a person tapping a button, carries out a purchase or a payment on someone's behalf.

That case raises a question the ordinary card flow was not built to answer: how does a merchant, a bank or a payment network know that the agent really acted on the user's instructions, and stayed within the limits the user set? AP2's answer is a signed record of those instructions.

Mandates: signed proof of instruction

AP2 builds trust on Mandates — tamper-proof, cryptographically signed digital contracts that act as verifiable proof of a user's instructions ^[1].

Two situations are distinguished. In a real-time purchase, an Intent Mandate captures the request, and a Cart Mandate records the exact items and price once the user approves them ^[1]. For delegated tasks, the Intent Mandate sets price limits, timing and other conditions in advance, which lets the agent generate a Cart Mandate later on the user's behalf, for instance when the user is not there to confirm ^[1].

The chain from intent to cart to payment creates a non-repudiable audit trail that answers questions of authorisation and authenticity: who authorised what, and can the record still be trusted afterwards ^[1].

Payment-agnostic and composable

AP2 sets a payment-agnostic framework covering credit and debit cards, stablecoins and real-time bank transfers, so the same authorisation logic is meant to sit on top of whichever payment rail is used ^[1]. It can also be used as an extension of the Agent2Agent protocol and the Model Context Protocol ^[1] — the conventions Google has put forward for how agents talk to one another and how they reach tools and data. An agent that can already hand a task to another agent can attach payment to it instead of building a separate payment stack.

Who is involved

Google says it is collaborating with more than 60 organisations, including Adyen, American Express, Ant International, Coinbase, Etsy, Intuit, JCB, Mastercard, PayPal, Revolut, Salesforce, ServiceNow, UnionPay International and Worldpay ^[1]. The list spans card networks, payment processors and wallets, commerce platforms and enterprise software vendors.

A crypto extension

With Coinbase, the Ethereum Foundation and MetaMask, Google extended AP2 with the A2A x402 extension for agent-based crypto payments ^[1].

Where it sits

Payments work because each side can check that the payer authorised the transaction; that check is what separates a payment from a transfer of value nobody agreed to. When an agent acts, the moment of "user present to confirm" disappears, so authorisation has to be captured beforehand and travel with the transaction. Mandates are how AP2 records that authorisation, and the protocol deliberately leaves the movement of money to the existing card, stablecoin and bank systems.

What AP2 specifies is the record of instruction and the audit trail around it, not the settlement itself. Because it is published as an open protocol with a broad group of payments and technology companies involved, its practical reach depends on those organisations implementing it in their own products and rails.