I read the three specs side by side, looking at what a PSP has to build, not what the announcements say.
ACP (OpenAI and Stripe) is the narrowest. The agent gets a scoped, single-use payment token and the merchant's PSP charges it. For you it's mostly a new credential type on an existing authorize call.
AP2 (Google) is about proof. Signed mandates record what the user authorized, either a cart or an intent with limits. The payment still travels on normal rails, but the mandate has to ride along so an issuer or a dispute reviewer can see it later.
UCP (Google) sits one level up. It covers checkout, order state and identity linking between agent and merchant, and it is meant to work with AP2 for the payment step.
My read: don't pick a winner. Build the layer all three need. That means accepting agent-scoped tokens, storing the authorization evidence next to the transaction, flagging agent-initiated traffic in your risk rules, and keeping idempotency and webhooks strict, because agents retry harder than humans do.
The open question is disputes. If an agent buys the wrong thing inside a valid mandate, whose chargeback is it? Has anyone seen a scheme rule on this yet?
Payneteasy handles this kind of payment flow for merchants and PSPs — see how it works.
Top comments (0)