The Infrastructure Problem Behind AI Shopping
AI agents can already research products, compare prices, and recommend purchases. What they cannot reliably do is pay for things. The missing piece is not the intelligence — it is the payment infrastructure. How does an AI agent prove it has authorization to spend your money? How does a merchant verify the transaction is legitimate? How do you set spending limits on software that operates autonomously?
Mastercard’s Agent Pay is the company’s answer: a comprehensive framework of technical standards and governance rules that allows AI agents to transact within the existing card payment system. First unveiled in April 2025, the framework has rapidly evolved from concept to implementation, with authenticated agentic transactions going live across ASEAN markets in 2026.
How Agentic Tokens Work
At the core of Agent Pay are Mastercard Agentic Tokens — dynamic, cryptographically secure credentials that build on the same tokenization technology behind mobile contactless payments, secure card-on-file storage, and Mastercard Payment Passkeys. Each AI agent is uniquely identified and then enabled to initiate transactions using these tokens, ensuring every purchase is both traceable and authenticated without exposing sensitive card numbers.
The system solves three problems simultaneously. First, consumer authorization: the agent can only spend within parameters the cardholder has explicitly set. Second, merchant verification: retailers can validate that an AI-initiated purchase comes from a legitimate, authorized agent. Third, audit trail: every transaction carries a cryptographic record of who authorized what.
Advertisement
Verifiable Intent: The Trust Layer
In March 2026, Mastercard and Google launched Verifiable Intent, an open-source trust layer that creates a tamper-resistant record of what a user authorized when an AI agent acts on their behalf. The standard links identity, intent, and action into a single, privacy-preserving record using a technique called Selective Disclosure that shares only the minimum information needed with each party in a transaction.
Verifiable Intent is aligned with Google’s Agent Payments Protocol (AP2) and Universal Commerce Protocol, and integrates with on-device biometric authentication via FIDO and EMVCo standards. Mastercard open-sourced the specification on GitHub and secured commitments from Google, Fiserv, IBM, Checkout.com, Basis Theory, and Getnet.
The Partnership Ecosystem
The speed of ecosystem adoption distinguishes Agent Pay from previous Mastercard initiatives. Fiserv has integrated the framework into its merchant acceptance infrastructure, enabling AI-initiated purchases to be authenticated, tokenized, and settled through existing card network rails. PayPal joined forces to allow AI agents to complete transactions on behalf of PayPal’s hundreds of millions of users.
Microsoft is bringing Agent Pay to Copilot Checkout, while the framework is also aligned with OpenAI’s Agentic Commerce Protocol. This means AI assistants from Microsoft, Google, and OpenAI will all be able to make purchases through a common set of tokenization and verification standards.
What This Means for Commerce
Agentic commerce represents a fundamental shift in how transactions originate. Instead of a consumer browsing, selecting, and checking out, an AI agent handles the entire purchase flow — from product discovery to payment — based on standing instructions. A consumer might tell their AI assistant to “reorder laundry detergent when we’re running low, but never pay more than $15,” and the agent autonomously handles the rest.
The implications extend beyond convenience. Merchants will need to optimize for AI agents, not just human shoppers. SEO becomes agent-optimization. Product descriptions need machine-readable structured data. Pricing strategies must account for agents that comparison-shop at superhuman speed. The companies that build agent-friendly commerce infrastructure early will capture disproportionate market share as agentic purchasing scales.
Frequently Asked Questions
How does Mastercard Agent Pay prevent unauthorized purchases by AI agents?
Agent Pay uses three-layer protection: Agentic Tokens that are cryptographically tied to specific users and agents, spending limits set by the cardholder, and Verifiable Intent records that create tamper-resistant proof of authorization. Each AI agent receives a unique identifier and can only transact within parameters the consumer has explicitly approved. On-device biometric verification via FIDO standards ensures the human behind the agent is authenticated.
Which companies have already integrated Mastercard Agent Pay?
Fiserv has integrated Agent Pay into its merchant acceptance platform. PayPal allows AI agents to transact on behalf of its users through the framework. Microsoft is connecting Agent Pay to Copilot Checkout. Google co-developed the Verifiable Intent standard. OpenAI’s Agentic Commerce Protocol is aligned with Agent Pay standards. Authenticated agentic transactions are already live across ASEAN markets.
When will AI agents routinely make purchases on behalf of consumers?
Agentic commerce is already live in limited deployments across ASEAN and through enterprise platforms like Microsoft Copilot. Routine consumer adoption is expected to scale through 2026-2027 as major AI assistants from Google, OpenAI, and Microsoft integrate Agent Pay standards. The infrastructure is in place — the pace of adoption depends on consumer trust and merchant readiness to serve AI agent customers.
Sources & Further Reading
- Mastercard Agent Pay: Secure, Scalable and Trusted Agentic AI — Mastercard
- How Verifiable Intent Builds Trust in Agentic AI Commerce — Mastercard
- Fiserv Integrates Mastercard Agent Pay Into Merchant Platform — PYMNTS
- Mastercard and PayPal Join Forces to Accelerate Agentic Commerce — PayPal Newsroom
- Mastercard Unveils Open Standard to Verify AI Agent Transactions — PYMNTS
- Exclusive: Mastercard Moves to Set the Rules for AI-Driven Commerce — Axios













