Death of the Checkout

ACP and the Shift in Control

“In many cases, the user interface to a program is the most important part for a commercial company: whether the program works correctly or not seems to be secondary.”

Linus Torvalds, creator of Linux

A big shift in how online checkout works is starting to take shape. The Agentic Commerce Protocol (ACP), co-authored by Stripe and OpenAI, marks the first stage of this change, but it will go much further over time.

Let’s start with a quick reminder of what ACP is and why it matters.

What is ACP?

ACP is an open-source specification that defines how third-party agents can interact with and purchase from a merchant. Technically, it’s an API specification that lets any merchant expose their checkout flow - including the payment component - through an API interface.

The elegant part of ACP is twofold:

1. The merchant remains the merchant of record (“MoR”). The agent app is not the seller; the customer is still buying directly from the merchant.

2. It works as an overlay on top of existing merchant infrastructure. It’s designed to fit naturally with current systems like order management and payment processors.
   

With that in mind, there’s one major change to how online commerce works: the checkout interface.

Traditionally, after filling a cart, a buyer moves to the checkout page - choosing payment methods, adding shipping details, and entering personal information. This comes in many forms: wallets like PayPal, Apple Pay, or Google Pay, or stored card systems like Stripe Link.

The checkout has always been the intersection of multiple systems and business functions:

• Payment method selection

• Fraud prevention

• Shipping options

• Upsell and marketing flows

In the ACP model, the merchant’s checkout becomes headless - API-based - while the user interface for choosing payment methods moves to the agent.

ACP Checkout Flow - Before and After

This shift changes a lot:

• Fraud providers that relied on JS scripts to monitor IPs or cookies that lives on the merchant checkout, are now blind (the fraud detection systems move to the agent wallet).

• Merchants lose direct control over upsells and on-page marketing.

• Merchants also lose control over which payment methods are displayed and chosen.

In some cases, theses changes shift the balance of control. Take payment method selection as an example. Traditionally, merchants decided which payment methods to accept, often managed through their payment processor or commerce platform (like Shopify).

Under ACP, when an agent facilitates a checkout session, the merchant responds with details about which PSP and payment methods they use. Right now, this is loosely defined and looks something like:

“create_checkout_session_response”: {
  “id”: “checkout_session_123”,
  “payment_provider”: {
    “provider”: “stripe”,
    “supported_payment_methods”: [”card”]
  }
}

What’s unclear is how specific supported_payment_methods should be. Does it mean “cards” in general, or should it include specific wallets or apps? For instance, if OpenAI’s agent supports Apple Pay and the PSP can process it, should the merchant automatically accept it? Technically, there’s nothing preventing that - Apple Pay is just a network token wrapper that the PSP can handle directly.

But traditionally, that decision belonged to the merchant. With ACP, the routing of which card or wallet is used moves to the agent. That means a significant amount of discretion - and power - shifts away from the merchant.

A Shift in Responsibility

Although OpenAI made the right call by keeping the merchant as the merchant of record (a great, non-trivial choice), they will almost certainly need to share some responsibility for the purchasing process. Fraud isn’t just bad for the merchant or the payment stack downstream - it’s also bad for OpenAI. In fact, it’s arguably worse for OpenAI than for the merchant.

If users get scammed, they’ll mostly blame OpenAI (they don’t care about MoR or legal definitions). And if merchants experience chargebacks or friendly fraud, they’ll also point fingers at OpenAI, since much of the fraud detection and decisioning now shifts to the agent layer.

The equilibrium of this new dynamic is that OpenAI (or any agent operating through ACP) becomes a facilitator that must own part of the responsibility. Looking forward, this could become a big deal - not just operationally, but legally and reputationally. Maybe the MoR definition will actually needs to be tweaked or we will need some new definition like AoR - Agent of Record.

What’s Next

These are still early days, but things move fast in AI land. Next year will likely be a turning point for agentic commerce. Many of the questions raised above are now being debated by major players across the industry, as they present both an opportunity for new businesses to emerge and a threat to existing ones.

It’ll be interesting to watch:

1. What merchants are saying publicly about ACP and how they adapt

2. How the ACP spec evolves with real-world feedback

The upcoming holiday season will be the first real stress test - a glimpse into what agentic commerce feels like at scale.

If you have questions about implementing ACP checkout for your ChatGPT app or Instant Checkout integration, or if you want to build a commerce agent with an agentic wallet that can handle payments - reach us anytime at [email protected].

Subscribe to get the most up-to-date analysis of agentic commerce.