Agent Payments Protocol (AP2)

At its core, AP2 solves the problem of trust in automated commerce. By leveraging SD-JWT (Selective Disclosure JSON Web Tokens), the protocol allows users to grant agents specific, verifiable permissions to execute transactions without exposing full account credentials or granting blanket access to funds.

Mandate Mechanism

The primary primitive of AP2 is the mandate. Rather than a single bundle, AP2 utilizes a chain of separately signed mandates to create a non-repudiable audit trail. The process begins with an Intent Mandate, followed by a Cart Mandate upon user approval. The specification defines two specific mandate types: the Checkout Mandate, which provides the merchant with cryptographic proof that the agent is authorized to purchase the assembled checkout, and the Payment Mandate, which provides the credential provider, network, and merchant payment processor with proof that the agent is authorized to pay for that specific checkout. Each link in this chain is signed independently to ensure strict adherence to human-defined scope.

The Analogy: A Restricted Shopping List

Think of an AP2 mandate as a digital, notarized power-of-attorney combined with a strictly limited shopping list. If you send an agent to the store, you don’t give them your entire bank account and a blank check. Instead, you give them a signed note that says: ‘You are authorized to spend up to $50 on groceries, and nothing else.’ The store clerk (the payment processor) checks the signature, verifies the limit, and processes the transaction only if it matches your specific instructions. If the agent tries to buy a luxury watch instead of groceries, the mandate is rejected because it falls outside the signed parameters.

AP2 vs. TAP: Complementary Signals

A common misconception is that AP2 replaces other agent security standards. In reality, AP2 works in tandem with the Trusted Agent Protocol (TAP). While AP2 provides the cryptographic proof of human intent and authorization for the payment itself, TAP provides the signal of agent legitimacy—verifying that the software entity making the request is who it claims to be. Together, they create a complete security stack for autonomous commerce.

Autonomous Payments: Human Not Present

AP2 supports ‘Human Not Present’ autonomous payments, a capability defined in the v0.2 specification. It allows agents to execute transactions in the background, even when the user is offline, provided the agent is operating within the bounds of pre-authorized user instructions. Within those limits, an agent can run recurring replenishment or service renewals under the same mandate security as a manual transaction.