How do merchants tell the difference between AI agents and bots?

Through cryptographic credentials. Visa's Trusted Agent Protocol and Mastercard's Agent Pay require legitimate AI agents to present digitally signed authorization documents. Bots cannot produce valid cryptographic proofs of user authorization.

What is the UCP discovery endpoint?

Google's UCP includes a /.well-known/ucp endpoint where merchants declare their capabilities and agents identify themselves. This machine-readable discovery layer allows both parties to verify each other before any transaction.

AI Agent Verification: How Merchants Know They're Dealing With a Real Agent

AI agent verification is the process by which merchants confirm that an AI agent requesting a transaction is legitimate, authorized, and operating within defined permissions — as opposed to a bot, scraper, or malicious actor.

This is the gatekeeping problem of agentic commerce. Merchants have spent decades fighting bot traffic. Now they need to let some automated agents through while blocking others. The difference between a legitimate AI shopping agent and a credential-stuffing bot is the difference between revenue and fraud.

How Verification Works Today

Visa’s Bot-vs-Agent Distinction

Visa’s Trusted Agent Protocol addresses this directly. It’s an open framework built on existing web infrastructure whose primary function is helping merchants distinguish between malicious bots and legitimate AI agents. The protocol uses digitally signed credentials: when an AI agent approaches a merchant’s checkout, it presents a cryptographic document proving its identity, the user it represents, and the scope of its authorization.

Mastercard’s Agent Suite

Mastercard’s Agent Pay takes a similar approach through its partnership with Google’s UCP. Merchants using Mastercard’s Agent Suite can verify incoming agent requests against the UCP protocol’s identity layer.

UCP’s Discovery Endpoint

Google’s UCP includes a /.well-known/ucp discovery endpoint that agents use to identify themselves and their capabilities to merchants. This is the machine-readable equivalent of a storefront — it tells incoming agents what the merchant supports, and it allows the merchant to validate the agent’s identity before processing any transaction.

Cloudflare’s Infrastructure Layer

Cloudflare published a technical guide on securing agentic commerce, providing the CDN and edge computing infrastructure that can enforce agent verification at the network level — before requests even reach the merchant’s servers.

The Five Things Merchants Verify

Agent identity. Is this agent from a recognized platform (ChatGPT, Google AI Mode, etc.)?
User authorization. Does the agent have verifiable intent credentials proving a real user authorized this action?
Scope compliance. Is the requested transaction within the authorization’s spending limits, category restrictions, and time window?
Credential freshness. Has the authorization credential expired? Has it been revoked?
Transaction integrity. Do the transaction details match what the credential authorizes?

What Happens When Verification Fails

If any check fails, the transaction is rejected and the agent receives a structured error response explaining which verification step failed. This is architecturally cleaner than traditional bot detection (CAPTCHAs, rate limiting) because the agent can programmatically understand the rejection and either request updated credentials from the user or route to a different merchant.

How Merchants Verify an AI Agent’s Identity at Checkout

Merchants verify an AI shopping agent at checkout by confirming three things before the transaction is authorized: who the agent is (a registered, cryptographically identifiable agent), who authorized it (a specific human principal who granted consent), and what it is allowed to do (a scoped mandate covering the merchant, the amount, and the spending limit). In practice this means validating a signed payment mandate or scoped token, checking that its signature comes from a trusted issuer or payment network, and ensuring the cart, price, and merchant all fall inside the boundaries the user approved. Checkout completes only when every condition holds.

Under the emerging 2026 standards stack, agent identity and authority are no longer inferred from a session cookie or a shared password. They are carried in tamper-evident, machine-readable credentials: a UCP discovery handshake plus a signed request, an OAuth 2.1 access token scoped to the agent, and a chain of cryptographically signed mandates (Google’s AP2) or a narrowly scoped payment token (OpenAI and Stripe’s Agentic Commerce Protocol, or a Visa/Mastercard agent credential). The merchant’s job is to verify that chain end to end rather than to trust the agent’s word.

Step-by-Step Verification Flow

Discovery and capability handshake. The agent fetches the merchant’s /.well-known/ucp manifest to learn which capabilities (catalog search, cart, checkout, order management) and which payment handlers the merchant supports. The manifest declares each capability’s name, version, and JSON Schema URL, so the agent knows exactly how to format a compliant request.
Identify the agent. The agent presents a distinct, verifiable identifier. Under UCP this travels in the UCP-Agent request header alongside a request-signature; under MCP/OAuth it is an access token bound to a specific client. The merchant resolves that identifier to a known, registered agent and rejects anonymous or unregistered callers if policy requires it.
Authenticate and authorize the call. The merchant validates the OAuth 2.1 access token (short-lived, scoped, audience-bound so a token minted for one merchant cannot be replayed against another) or verifies the request signature against the agent’s published key.
Verify user consent and intent. The merchant inspects the mandate or delegated-payment credential to confirm a specific human authorized this purchase. Under AP2 this is the signed Intent Mandate (what the user wanted) and Cart Mandate (the exact items and price the user approved).
Check scope and limits. The merchant confirms the transaction falls inside the approved constraints: correct merchant, amount at or below the spending cap, allowed product category, and a valid (unexpired) authorization window.
Validate the payment credential. The merchant or its payment service provider (PSP) verifies the network-issued agent token or shared payment token, confirming it is bound to this agent, this merchant scope, and this consent policy before settling.
Authorize, settle, and log. On success, the merchant processes payment as it would any order and retains the signed mandate chain as a non-repudiable audit trail for dispute, chargeback, and accountability purposes.

Verification Methods Compared

Method	What it proves	How it works	Maturity / adoption (2026)
Cryptographic agent identity / signed mandates	The agent is a known key-holder and a specific human authorized this exact purchase	Mandates are signed digital contracts (W3C Verifiable Credentials) chaining intent to cart to payment; the merchant verifies signatures and the audit trail	Defined in Google’s AP2; v0.2 released April 2026 and donated to the FIDO Alliance; 60+ partner organizations
OAuth 2.0 / 2.1 token-based agent authentication	The calling agent is authenticated and authorized for a scoped action on behalf of a user	Short-lived, audience-bound access tokens (PKCE for public clients; client-credentials grant for human-not-present calls); token specifies which resource it is valid for	Widely deployed; OAuth 2.1 required by the MCP authorization spec; mature, battle-tested base layer
Payment-network agent credentials and tokenization (Visa Intelligent Commerce, Mastercard Agent Pay)	The payment instrument is valid and bound to a specific agent, merchant scope, and consent policy	Network-issued tokens replace the card number and are scoped by use case and spending limit (a $200-cap token cannot authorize $500; a grocery token cannot book travel); issuer-side authentication for machine-initiated payments	Visa Intelligent Commerce and Mastercard Agent Pay launched 2025, shipping production integrations across multiple agent protocols in 2026
Google AP2 (Agent Payments Protocol)	Authorization, authenticity, and accountability across the whole transaction	Three signed mandates (Intent, Cart, Payment) as verifiable credentials; supports human-present and human-not-present (pre-authorized) flows; extends A2A and MCP	Open standard governed via FIDO Alliance; integrated as a payment layer under UCP; broad payment-network and platform support
Agentic Commerce Protocol (OpenAI + Stripe) delegated payment	The agent may complete a specific, user-approved purchase using a narrowly scoped credential	A delegated payment / shared payment token is issued and is unusable outside the limits of the approved purchase; merchant or PSP processes it like any normal order; accept/decline allowed per agent or per transaction	Maintained by OpenAI and Stripe; live (Instant Checkout in ChatGPT) for Etsy and rolling out to Shopify merchants in 2026
UCP `.well-known/ucp` endpoint and agent discovery	The agent can discover the merchant’s capabilities and address its request to the correct, signed endpoint	A single JSON manifest declares services, capabilities (name/version/schema), and payment handlers; requests carry `UCP-Agent`, `request-signature`, and idempotency headers over REST, JSON-RPC, MCP, or A2A	Open standard from Google and Shopify with a 20+ retailer coalition; announced at NRF 2026 (January 2026)

Merchant Verification Checklist

Publish a complete, current /.well-known/ucp manifest so compliant agents can discover capabilities and the correct payment handlers.
Require every agent to present a distinct, resolvable identifier (e.g., UCP-Agent header or OAuth client identity) — do not accept anonymous callers for write/checkout actions.
Validate request signatures against the agent’s published key, and reject unsigned or tamper-altered requests.
Verify OAuth tokens are short-lived, scoped, and audience-bound to your endpoint; reject replayed or over-broad tokens.
Confirm a signed user mandate (or delegated-payment credential) authorizes this specific purchase, and that its issuer is trusted.
Enforce scope on every transaction: correct merchant, amount within the spending cap, allowed category, and an unexpired authorization window.
Validate the network token or shared payment token is bound to this agent and merchant scope before settling.
Apply an accept / decline / step-up policy per agent or per transaction for high-risk, high-value, or out-of-pattern orders.
Use idempotency keys to prevent duplicate agent-driven charges.
Retain the signed mandate chain as a non-repudiable audit trail for disputes, chargebacks, and accountability.

Trust Signals: Verifiable Intent, Consent, and Spending Limits

Verifiable intent is the anchor. Rather than trusting that an agent “meant” to buy something, the merchant relies on cryptographically signed proof of what the user instructed. AP2’s Intent and Cart Mandates, and Mastercard’s Verifiable Intent (co-developed with the AP2 effort and donated to FIDO), produce a tamper-evident log binding the user’s authorization to the agent’s action — which directly addresses the risk of agent error or hallucination.

User consent and mandates establish authority. A mandate is the on-the-record permission slip: it names the human principal, the agent, and the boundaries of what was approved. A human-present flow signs the cart at approval time; a human-not-present flow signs an upfront mandate with predefined rules (price ceiling, timing, conditions) that the agent must satisfy before acting.

Spending limits and scope contain the blast radius. Tokens and mandates are deliberately narrow: a credential carries a maximum amount, a merchant or category scope, and an expiry. A grocery-shopping token cannot pay for travel, and a $200-limit token cannot clear a $500 charge. Merchants should treat these constraints as hard gates — verify them on every call, and step up to additional confirmation when a request sits at the edge of, or outside, the approved envelope.

Frequently Asked Questions

How do merchants verify AI agent identity during checkout?

Merchants resolve the agent’s verifiable identifier (such as a UCP-Agent header or an OAuth client identity), validate the request signature or scoped access token, and then confirm a signed mandate or delegated-payment credential proves a specific user authorized the purchase. They also check the amount, merchant, and category fall within the approved scope before settling and logging the signed mandate chain.

What does AI agent verification before transactions mean?

It means proving, before any money moves, that the software agent submitting the payment is a known registered agent, is currently authorized by a specific human, and is operating within a scoped mandate. Verification binds agent, user, and intent into a single signed credential so the merchant can authorize with confidence and retain an audit trail for accountability.

What is merchant verification of AI agent identity?

It is the merchant-side process of authenticating the calling agent and authorizing its action: validating its credential and signature, confirming user consent via a mandate, enforcing spending limits and merchant scope, and applying an accept/decline policy per agent or per transaction. It uses standards such as OAuth 2.1, AP2 mandates, the Agentic Commerce Protocol’s delegated payment token, and Visa/Mastercard agent credentials.

How does AI agent identity verification at checkout work technically?

The agent discovers capabilities via the merchant’s /.well-known/ucp manifest, then sends a signed, identified request. The merchant validates the signature and OAuth token, verifies the AP2 Intent and Cart mandates (W3C Verifiable Credentials) or a scoped delegated-payment token, checks scope and limits, validates the network payment token, and only then authorizes — keeping the signed mandate chain as proof.

Which standards govern AI agent verification in 2026?

The main standards are the Universal Commerce Protocol (UCP) for discovery and capabilities, OAuth 2.1 (required by the MCP authorization spec) for agent authentication, Google’s Agent Payments Protocol (AP2) for signed mandates and verifiable intent, the OpenAI and Stripe Agentic Commerce Protocol (ACP) for delegated payment tokens, and Visa Intelligent Commerce and Mastercard Agent Pay for network-issued agent credentials and tokenization.

How do spending limits and mandates prevent unauthorized agent purchases?

Credentials are deliberately scoped. A mandate or token carries a maximum amount, a merchant or category restriction, and an expiry, so a grocery-agent token cannot book travel and a $200-cap token cannot authorize $500. Because these limits are cryptographically bound to the credential, the merchant can reject any request that exceeds them, containing the impact of a misbehaving or compromised agent.

What happens if an AI agent fails verification at checkout?

The merchant declines the transaction. ACP, UCP, and the card-network frameworks all let merchants accept or decline on a per-agent, per-transaction, or custom-logic basis, so an unsigned request, an expired or over-scope mandate, an invalid token, or an unrecognized agent is rejected — and the merchant can step up to additional user confirmation rather than guess.

AI Agent Verification: How Merchants Know They’re Dealing With a Real Agent