This year every payment network and every AI lab shipped a way for an agent to pay. OpenAI and Stripe have the Agentic Commerce Protocol. Google has AP2, the Agent Payments Protocol, and the Universal Commerce Protocol that Shopify builds into every store. Mastercard has Agent Pay, Visa has Intelligent Commerce, and Stripe and Tempo have the Machine Payments Protocol for paying by the request. The question nobody has measured is the merchant side: of all this, what does a real store actually declare?
So we read it. We took the 1,065 live Shopify storefronts from our September study and fetched, from each one, every public document these protocols define: the UCP profile with its payment handlers, the ACP discovery document, the A2A agent card where AP2 is declared, and the OpenAPI document that MPP uses to advertise prices. No carts, no checkouts, no payments. Just what a store says about itself to an agent that asks.
What we found
- 1,051 of 1,065 stores declare exactly the same three payment handlers: Google Pay, Shop Pay and Shopify's own card handler, with the same four card networks. Not one of them chose this. It is what Shopify writes into
/.well-known/ucpfor every store on its standard storefront. - One store publishes a valid ACP discovery document. One more publishes a file at the ACP address in a shape the discovery RFC does not define, which an agent following the RFC would not recognise. The other 1,063 publish nothing there.
- Two stores declare AP2. Both do it on an A2A agent card. Not one of the 1,051 UCP profiles declares the AP2 mandate capability that UCP itself defines.
- Two stores advertise MPP terms in an OpenAPI document. One names a registered payment method. The other names one we could not find in the published method list.
- Mastercard Agent Pay cannot be observed from outside at all. There is no merchant-side file, header or endpoint. What we can say is that all 1,051 default profiles accept Mastercard network-token cryptograms through Google Pay, which is the credential type an Agent Pay agentic token is. The rail is open; enrolment is invisible.
- The two stores that did write their own files are the same two stores. One merchant implemented ACP, AP2 and MPP together; the other attempted all three. Everyone else is at zero.
The honest reading is that agent payments on Shopify are, today, a Shopify decision and not a merchant decision. That is not a criticism of the merchants. A store that has done nothing is already better placed than most of the internet, because its platform declared payment handlers on its behalf and an agent can complete a UCP checkout against them. But it also means the five competing protocols have, so far, exactly two merchants' worth of adoption between them on the largest independent-store platform there is.
What each protocol asks a store to publish
| Protocol | Where a store declares it | Stores declaring it |
|---|---|---|
| UCP payment handlers (Google, Shopify) | payment_handlers in /.well-known/ucp | 1,052 |
| ACP (OpenAI, Stripe) | /.well-known/acp.json | 1 valid, 1 malformed |
| AP2 (Google) | dev.ucp.common.payment.ap2_mandate in the UCP profile, or an extension on /.well-known/agent-card.json | 2 |
| Mastercard Agent Pay | Nothing public. Agentic tokens travel the store's normal card processing. | not observable |
| MPP (Stripe, Tempo) | x-payment-info in /openapi.json, and a 402 challenge at request time | 2 |
One of these numbers deserves a caveat, and it is the ACP one. ACP's discovery document is still a proposal in the spec repository, not part of a released snapshot, and ACP merchants are mostly onboarded privately through OpenAI or a payment platform rather than by publishing a file. A store with no acp.json may well be live in ChatGPT checkout through Shopify's own integration. What the number tells you is that an agent arriving at the domain cold cannot find out. The same is true of Agent Pay. We scored a store that declares nothing as not testable, not as failing, and the scanner does the same.
The one merchant who did it
Shapermint publishes all three. Its ACP document is the minimal valid form: protocol name, version, an HTTPS API base, REST transport and a checkout service. Its agent card declares the AP2 extension with the merchant role. Its OpenAPI document carries an MPP offer with method: stripe and intent: charge. We did not test whether any of the three endpoints behind those files actually completes a payment, and we are not claiming they do. We are noting that in a sample of 1,065 stores, one merchant read all three specifications and wrote the files, and that this is what the top of the adoption curve looks like right now.
How we tested it, and what we refused to claim
Five requests per store, all GET, all to published addresses. A document a store does not publish is not testable. A document we could not read because the store refused us is also not testable, and is never reported as a finding about the merchant. A document that is published and does not parse, or parses to something other than what the protocol defines, is the only thing we report as a problem, and 1,065 stores produced one of those.
Why "declares" and not "supports"
Every number on this page is about what a store says, not what it does. We did not attempt an ACP checkout session, present an AP2 mandate or pay an MPP challenge, because each of those would mean creating a payment against a real merchant. The UCP cart test in the main study stops at the checkout handoff for the same reason. A declaration is the most that can be verified without spending money, and it is also the thing an agent reads first, so it is the right thing to measure.
Payment handlers were read from the UCP profile with redirects disabled, because UCP clients are required not to follow them. The Mastercard inference looks for a declared handler that lists MASTERCARD among its card networks and CRYPTOGRAM_3DS among its authentication methods; it is labelled inferred wherever it appears and it never claims enrolment.
What this means if you run a store
- If you are on standard Shopify, an agent can already pay you. Your profile declares Google Pay, Shop Pay and card. You did not have to do anything, and you should not undo it.
- If you have customised your storefront, check that the profile still exists. Thirteen stores in this sample either publish no UCP profile or refuse the request. Those are the stores where an agent has no handler to pay through.
- Do not write an ACP, AP2 or MPP file because this page exists. The agents that use those protocols are reaching merchants through their platforms, not through a file at your domain. If you are on Shopify, Shopify's integration is the path. The two merchants who wrote their own are building their own storefront stack.
- Decide who is allowed to pay you before it matters. None of these protocols is the hard part. The hard part is the thing we measured last week: the stores we tested could not tell one agent from another, so they cannot say yes to one and no to the rest.
Per-store results, CC BY 4.0: payments-2026-10.csv, one row per store with its handlers, card networks and the verdict on each protocol. Fetched 5 October 2026 as part of a full rescan of the study; the rescan's other numbers are at /research#benchmark. Specifications read: the ACP discovery RFC in the ACP repository, the UCP AP2 mandates extension, and MPP discovery. Our own UCP profile is at /.well-known/ucp.
What does your store declare?
The same engine that produced these numbers runs against your storefront, including the five payment checks. Free, about a minute, one test cart created and cancelled.
Scan my store