Agentic Checkout: Get Your Burnaby Storefront Ready

A customer in Burnaby asks their assistant to find a replacement part, compare three shops, and just buy it. The assistant does all of it. Nobody browses your site. Your first contact with that order is a webhook hitting your server at 11pm.

That's agentic checkout. It isn't science fiction anymore, because the companies that run the payment rails have already published the specs.

What agentic checkout actually means

Two protocols matter so far, and they're betting on different things.

The Agentic Commerce Protocol, maintained by OpenAI and Stripe, lets a shopper finish a purchase inside ChatGPT while the order lands in your normal backend. The detail small shops should read twice is about liability. Per the OpenAI commerce docs, "OpenAI is not the merchant of record in the Agentic Commerce Protocol." You are. You set fulfillment options, you calculate sales tax, and "the merchant accepts or declines the order."

Payment doesn't work the way most owners assume. The agent never gets a card number. OpenAI prepares a one time delegated payment request with a maximum chargeable amount and an expiry, and a payment provider returns a token against it. The same docs describe Stripe's Shared Payment Token as "the first Delegated Payment Spec-compatible implementation."

Google's Agent Payments Protocol attacks a different question: how do you prove a human actually authorized this? AP2 was announced on September 16, 2025, and the documentation site listed v0.2 when I read it in September 2026. It uses signed mandates. A Checkout Mandate "captures the reference to the specific items and purchase details negotiated between the agent and the merchant," and a Payment Mandate "authorizes a payment against a specific payment instrument." AP2's docs say standardization continues inside FIDO's Agentic Authentication and Payments technical working groups, which tells you it isn't finished.

Same underlying problem either way. Software shows up holding money, and you need a reason to trust it.

The plumbing merchants are asked to build

The Agentic Checkout Spec is specific. A merchant implements five REST endpoints: create a checkout session, update it, complete it, cancel it, and fetch it. Every inbound request carries an Idempotency-Key, a Request-Id, a Signature over the body, an RFC 3339 Timestamp, and an API-Version. You echo the idempotency and request IDs back on the way out. The spec is blunt that "all endpoints must use HTTPS and return JSON," and that you enforce idempotency so retries are safe.

Going live has its own bar. OpenAI's production guide states "all traffic to you must use TLS 1.2 or later on port 443 with a valid public certificate," asks you to allowlist their published IP ranges, and warns that "OpenAI may require your attestation of compliance (AOC) before enabling production access" for PCI purposes.

There's also a catalogue feed: identifiers, descriptions, pricing, inventory, media and fulfillment options, sent as a validated sample first and then daily snapshots.

Read all that as a real engineering project with a security review attached, not a plugin you install on a Tuesday.

Being readable before you're buyable

Almost no independent shop in Metro Vancouver is writing checkout endpoints this quarter. That's fine, because the cheap work is different: be machine readable first.

Google's merchant listing structured data docs require `name`, `image`, `offers`, `offers.price` and `offers.priceCurrency`, note that merchant listings "require a price greater than zero," and require a nested Offer because "the merchant has to be the seller." Interestingly, `availability` sits under recommended rather than required, which is a gap worth closing yourself since stock status is exactly what an agent needs.

If your price only exists inside a JPEG, or your stock count lives in a spreadsheet on somebody's laptop, no agent can transact with you regardless of which protocol wins.

Verifying the agent on your doorstep

Once agents buy things, impersonating one becomes worth money. Cloudflare's Web Bot Auth builds on RFC 9421 HTTP Message Signatures and adds three headers: Signature-Input carrying a validity window, key ID and a `web-bot-auth` tag, Signature carrying the signature itself, and Signature-Agent pointing at where your server fetches the public key. As Cloudflare puts it, "the agent signs the target origin with a public key. When fetching https://example.com/path/to/resource, it signs example.com."

That gives you an actual answer to "is this OpenAI's operator, or someone in a rented data centre wearing its user agent string?"

Six things worth doing this quarter

• Put price, availability, SKU and shipping cost into Product structured data on every product page, not just the bestsellers.
• Make inventory truthful in near real time. An agent that buys something you don't have creates a refund and a bad review.
• Give returns, shipping and warranty policies their own plain text URLs. Agents quote policy pages back to buyers.
• Start logging User-Agent and any Signature-Agent header today, so you have a baseline before agent traffic gets interesting.
• Decide the order value above which a human must approve, and write it down.
• Confirm with your payment provider whether they support delegated payment tokens yet, before you plan anything around them.

Where this doesn't apply

Plenty of places, honestly.

Agents are still mediocre shoppers. In ShoppingBench, a benchmark built on a sandbox of millions of real product records, the authors report that "even state-of-the-art language agents (such as GPT-4.1) achieve absolute success rates under 50%." That's a research setting rather than your storefront, but it should temper any pitch that says agent buyers are a solved problem.

Security is unsettled. OWASP ranks prompt injection first in its 2025 Top 10 for LLM Applications and says plainly that "given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection." Their mitigations include least privilege and requiring human approval for high risk actions. A purchase is a high risk action.

The market is earlier than the headlines suggest. Statistics Canada's Q2 2026 analysis of AI use by businesses, released June 11, 2026, found 19.2% of businesses used AI to produce goods or deliver services over the previous 12 months, up from 12.2% in Q2 2025 and 6.1% in Q2 2024. Real growth, but 40.0% of businesses still said AI use "is not relevant to the business."

And the standards may not agree with each other. ACP and AP2 are solving overlapping problems in different ways, with FIDO standardization still in progress. Building deeply against one today is a bet, not a certainty.

If you sell services rather than SKUs, which describes a lot of New Westminster and Burnaby storefronts, agentic checkout mostly isn't your problem yet. Booking, quoting and answering the phone are, and those pay back sooner.

What we'd sequence first

An illustrative sequence, not a client result: a shop with a few hundred SKUs usually spends its first couple of weeks on catalogue hygiene, its next on structured data and policy pages, and only then looks at protocols. That order holds because clean product data helps your ordinary search traffic immediately, whether or not a single agent ever calls.

Sources

• OpenAI, "Key concepts, Agentic Commerce," OpenAI Developers documentation, accessed September 2026. https://developers.openai.com/commerce/guides/key-concepts
• OpenAI, "Agentic Checkout Spec," OpenAI Developers documentation, accessed September 2026. https://developers.openai.com/commerce/specs/checkout
• OpenAI, "In production, Agentic Commerce," OpenAI Developers documentation, accessed September 2026. https://developers.openai.com/commerce/guides/production
• Google, "AP2, Agent Payments Protocol Documentation," v0.2, announced September 16, 2025, accessed September 2026. https://ap2-protocol.org/
• Cloudflare, "Forget IPs: using cryptography to verify bot and agent traffic," Cloudflare Blog, accessed September 2026. https://blog.cloudflare.com/web-bot-auth/
• Google, "Merchant listing (Product) structured data," Google Search Central documentation, accessed September 2026. https://developers.google.com/search/docs/appearance/structured-data/merchant-listing
• OWASP GenAI Security Project, "LLM01:2025 Prompt Injection," OWASP Top 10 for LLM Applications, 2025. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• "ShoppingBench: A Real-World Intent-Grounded Shopping Benchmark for LLM-based Agents," arXiv:2508.04266, 2025, latest version June 2026. https://arxiv.org/abs/2508.04266
• Statistics Canada, "Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026," catalogue 11-621-M, released June 11, 2026. https://www150.statcan.gc.ca/n1/pub/11-621-m/11-621-m2026010-eng.htm

Not sure where your storefront sits on this? Book a free call with Autana Solutions. We'll look at your product data, your policy pages and your current order flow, and tell you honestly what's worth doing now and what can wait another year.