# Agent Payments Protocol (AP2)

> An authorization and governance framework for agent-initiated payments. It defines verifiable mandates that capture user intent and constraints, so an agent can transact on a user's behalf with an auditable chain of consent. Complements A2A and is rail-agnostic. Google donated AP2 to the FIDO Alliance in April 2026; v0.2 added Human-Not-Present autonomous transaction flows.

## At a glance

| Field | Value |
| --- | --- |
| Name | AP2 |
| Layer | payment-authorization |
| Category | framework |
| Status | live |
| Created by | Google |
| Launched | 2025-09 |
| Rails | — |
| Settlement | Delegates settlement to underlying payment rails; AP2 governs authorization. |
| Reversible | — |
| Human in loop | optional |
| D2C fit | strong |
| B2B fit | moderate |
| Spec | https://github.com/google-agentic-commerce/AP2 |
| Last verified | 2026-09-03 |

## How it works

AP2 addresses the **"was this payment actually authorized?"** problem for agent commerce. It does not move money itself; it standardizes **verifiable mandates** that prove a payment was consented to and bounded.

**v0.2** (April 2026) reorganized the mandate model from three types (Intent, Cart, Payment) into two — **Checkout Mandate** and **Payment Mandate** — each of which can be **Open** (pre-authorized constraints) or **Closed** (bound to a specific transaction). This gives Human-Not-Present flows a structured authorization model: users define bounded authority in advance, agents act without per-step approval, and merchants receive verifiable evidence that the transaction stayed within the granted authority.

- **Open Checkout / Payment Mandates.** Capture what the agent is allowed to buy and spend within user-defined limits.
- **Closed Checkout / Payment Mandates.** Signed by the authorized agent after confirming the transaction matches the user's constraints, producing a cryptographic link between authorization, checkout, and payment.
- **Receipts.** Checkout and Payment Receipts provide post-transaction evidence for audit and dispute.

**Verifiable Intent**, co-developed with Mastercard and also donated to FIDO, complements AP2 by creating tamper-proof, portable evidence of user authorization that issuers, networks, and merchants can independently validate.

Google donated AP2 and Verifiable Intent to the **FIDO Alliance** in April 2026. The core specification is now developed within FIDO's Payments Technical Working Group and Agentic Authentication Technical Working Group; the GitHub repository hosts SDKs and samples only. AP2 is deliberately **rail-agnostic**: it sits above card networks, bank transfers, and stablecoin execution protocols.

## Tradeoffs

- It authorizes but does not settle: an execution rail (card network, bank, or an on-chain protocol) is still required to move funds.
- Value depends on ecosystem adoption by credential providers and merchants to honor the mandates.
- As an evolving specification under FIDO governance, mandate formats and flows may change; integrations should track versioning.
- Human-Not-Present flows concentrate risk: pre-set limits and revocation must be enforced reliably, and mandate replay or manipulation could lead to unauthorized spending.

## Security & limitations

- The security model rests on the integrity of mandate issuance and verification; weak key management for mandates undermines the entire consent chain.
- Delegated (Human-Not-Present) mandates concentrate risk into pre-set limits and revocation, which must be enforced reliably.
- A systematic security analysis (arXiv 2608.23858, Aug 2026) found that valid mandate signatures alone do not ensure a transaction reflects user intent when the pre-authorization context is manipulated.

## Fits together with

- a2a
- x402

## Sources

1. [Powering AI commerce with the new Agent Payments Protocol (AP2)](https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol) — Google Cloud, 2025-09-16
2. [AP2 SDKs and samples (spec donated to FIDO)](https://github.com/google-agentic-commerce/AP2) — Google Agentic Commerce (GitHub)
3. [Google donates Agent Payments Protocol to FIDO Alliance (v0.2 announcement)](https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/) — Google, 2026-04-28
4. [Building the Trust Layer for Agentic Payments with AP2 and Verifiable Intent](https://fidoalliance.org/building-the-trust-layer-for-agentic-payments-with-ap2-and-verifiable-intent/) — FIDO Alliance

---
_Source: payful.ai — independent editorial reference. Verified 2026-09-03._