Agentic Checkout Checklist: 9 Fixes So an AI Agent Can Buy From You

Last week, Wix plugged an AI wallet into its small-business agents and
PayPal put agent checkout on 60 million living-room screens. Your
first thought was probably the same as mine: can an AI agent buy from
my store yet, and do I need to build something for it? I spent days
reading the protocols, the merchant pages, and the card-network rulebooks
so you can skip the news cycle and get the checklist instead. Short
version: the answer is yes, and the work is almost entirely on your own
checkout - the part you already own.

The short answer

Yes, an AI agent can buy from your store today - but almost certainly
through your own checkout page, not inside ChatGPT or Google AI Mode. The
in-chat checkouts are gated to approved platforms, mostly US-only, and
exclude subscriptions and digital goods. The agents that reach a normal
store - Meta's Muse, Amazon's Buy for Me, OpenAI's dots, Gemini's Task
agent - browse your product pages and finish payment on your site, through
your existing payment provider. So the useful question is not "which
protocol do I adopt" but "can an agent actually finish my checkout." Nine
fixes decide that, and most of them are configuration, not code.

The three ways an agent pays you

Before the checklist, you need the mental model, because "an AI agent
buys from you" covers three different things. This framing comes from
Okane Land's October 2026 review of the assistants' merchant pages and
terms, and it is the clearest cut I have seen:

1. In-chat checkout. The shopper stays in the assistant. The assistant runs the checkout and calls your systems through a protocol - the Agentic Commerce Protocol (ACP, from OpenAI and Stripe) or the Universal Commerce Protocol (UCP, from Google and Shopify). This path reaches sellers through Shopify, Etsy, PayPal, or Stripe, or by application - and it is US-buyer focused.
2. Agent on your site. The shopper's agent opens your product page and fills in your checkout the way a browser would, then pays through your own payment provider. This works on any site an agent can finish - no protocol, no approval, no platform middleman.
3. Machine payments for APIs. A software agent pays per request for your API through Stripe's Machine Payments Protocol or the x402 standard. This is the path for sellers of downloads, courses, or API access - agents buying compute, not t-shirts.

If you sell physical or digital goods on your own site, you mostly live in
path two. If you sell API access, path three deserves its own post. Path
one is the one getting all the headlines, so let me deflate it honestly
before we get to work.

What the in-chat checkouts actually cover

Here is the part the announcements skip. I have read the current merchant
terms so you can see how narrow path one really is for an independent
seller:

Three honest observations from that table. First, if you are not on
Shopify, Etsy, BigCommerce, Wix, or Shopware, path one is not open to you
today - and implementing ACP yourself does not fix that, because the
protocol's own site says each AI platform manages its own merchant
onboarding. Second, everything in path one sells to US buyers; if your
customers are in Pakistan, Europe, or anywhere else, path two is your only
path. Third, subscriptions and digital goods are excluded across the
board in path one, while path two has no such restriction - an agent can
buy your course or your SaaS plan on your own checkout exactly like a
human can.

AI-assisted buying is growing from a tiny base. A Frankfurt School study
of 973 online shops found chatbot referrals under 0.2% of traffic.
Ethercycle counted 0.10% of sessions and 0.12% of revenue from AI
assistants across ten established Shopify stores in 2026 - about
$131,000 out of $109.6 million. Shoppers are cautious too: about 14% of
Americans trust AI to place orders (YouGov), 11% have used AI to complete
a transaction, and seven in ten want the final say first (NMI). Fix your
checkout because it is cheap and durable, not because a tidal wave is
arriving tomorrow.

The part nobody warns you about: you eat the chargebacks

This is the section that changes the math on how much to invest. No card
network has moved the risk of agent purchases onto the agent. Visa's
rulebook (April 2026 edition, with agent rules added in October 2025)
treats the registered provider of an agent payment as the cardholder and
holds the cardholder responsible for the agent's actions as if they had
made the purchase themselves - and it forbids you from requiring a buyer
to waive dispute rights, agent purchases included. Mastercard's merchant
guide says standard fraud detection, chargeback rights, and dispute
processes apply to agent purchases. Stripe's seller terms make you the
merchant of record, responsible for disputes, refunds, and transaction
fraud. Worldpay's one-line summary is the one I would tattoo on the
project plan: no liability shift exists yet.

The unsettled case is the purchase that was authorized but wrong - the
agent bought what the shopper did not mean. Two companies have started on
it from the other side: Stripe's terms for agent operators make them
answerable to Stripe for purchases caused by bugs, hallucinations, or
misinterpretations, and American Express has announced a future protection
for cardholders whose purchase strays from approved intent. Neither
changes what you face when the chargeback arrives. So: keep your dispute
evidence habits exactly as they are, and do not assume an agent's mistake
is the agent's bill.

The checklist, part 1: make your checkout finishable

These are the fixes that decide whether an agent completes a purchase on
your site. Do them in order; each one removes a failure mode I keep seeing
in the agent-buying reports.

An agent cannot log into a user account it does not have, and it cannot
create one reliably mid-purchase. If your checkout forces account
creation before payment, you have built a wall that stops agents and
annoys humans equally. Keep account creation after payment - optional,
on the confirmation page, never in the critical path.


Browser-driven agents finish fastest with saved wallets. Stripe's Link
is the one with documented agent support - Meta's Muse pays instantly at
the million-plus businesses that accept it, using the shopper's saved
payment method - and Google Pay covers the Google-side agents. If you
already take Stripe, Link is usually a toggle, not a project. If your
only options are manual card entry plus a local bank transfer, an agent
will stall at the payment form exactly where a distracted human would
abandon the cart.


This one is counterintuitive and it is the fix most stores miss. Your
Cloudflare bot-fight mode, your WAF rules, your CAPTCHA on the checkout
page - they do not know the difference between a scraper and a signed
shopping agent, and they will block both. The networks have built the
plumbing for exactly this: Mastercard's Agent Pay builds on Web Bot Auth,
Visa's Trusted Agent Protocol aligns with it, and Cloudflare has counted
signed agents as verified bots since July 1 - with one warning worth
reading twice, that you may trust the intermediary operator but not
every end user driving it. The practical job: check your host or CDN's
bot settings and let verified agents through to the checkout, instead of
discovering the block in your failed-orders log.


Letting agents through does not mean letting them run wild. An agent
that retries a failing checkout can hammer your endpoints in a loop a
human never would. Put per-IP and per-session rate limits on cart and
checkout endpoints, and cap the retry behavior on your payment intents.
This is standard hardening, but agents make it load-bearing: the first
wave of agent traffic you see will include the buggy kind.

The checklist, part 2: be discoverable, then protect yourself

Once an agent can finish your checkout, the next question is whether it
can find your products - and what you do when something goes wrong.

Price, currency, availability, shipping cost, and the product name - in
the page itself, as text, not trapped inside images or JavaScript-only
widgets. Then mark it up: schema.org Product and Offer JSON-LD with the
same numbers. Google's own line is reassuring here: its AI features need
no special AI files or markup beyond what search already uses. The
stores that win agent discovery are the ones whose pages a dumb parser
can read, not the ones with the prettiest interactive configurator.


Agent discovery in path one runs on product feeds, not on vibes. If you
are on Shopify, your catalog is already in the channels Shopify
switches on by default. Otherwise, keep a clean feed in Google Merchant
Center and keep prices and stock accurate in it - stale feed data is
how an agent confidently sells a customer something you cannot ship.
Accuracy in the feed is a checkout fix, not a marketing chore.


Two bots decide whether you appear in AI answers. OpenAI's OAI-SearchBot
decides whether you show up in ChatGPT's search answers; GPTBot controls
training data and can be blocked independently. If you blocked all of
OpenAI's crawlers during the 2024 scraping panic and never revisited the
decision, you have opted out of ChatGPT product discovery entirely.
Review robots.txt this week: allow OAI-SearchBot, decide on GPTBot
separately. Five minutes of work, disproportionate payoff.


Remember the liability section: you are the merchant of record and no
network has shifted the risk. Log the agent signals your stack already
sees - signed-agent headers, the checkout session ID, the payment
token reference, the shipping address the agent submitted. From October
24, 2026, an agent provider's login ID can count as matching evidence
under Visa's Compelling Evidence 3.0 rules when you contest a fraud
dispute. Keep the logs now; the rule is only useful if the data exists.


Theory ends here. Take a shopping agent you can access - Meta's Muse,
ChatGPT's shopping, Gemini's Task agent - point it at your own store,
and buy your cheapest product with your own card. Watch where it
hesitates: the variant picker it cannot parse, the shipping calculator
that needs a postal code before showing options, the wallet button that
does not render for the agent's session. Every snag you find is a
conversion fix for humans too, which is why this test pays for itself
even if agent traffic stays at 0.1% for another year.

What to skip for now

A checklist that only says "do" is a sales pitch. Here is the honest
"don't" list, because most of the agentic-commerce noise wants your money
or your weekends:

• Don't build an ACP endpoint or an MCP commerce server yet. The protocols are young and still converging - ACP is in beta, UCP's spec is moving - and implementing one lists your products nowhere. Build it when a channel you want requires it, not before.
• Don't buy an "agent SEO" tool. Product discovery runs on the same structured data and feeds that regular SEO already uses. If a vendor cannot explain what their tool does beyond what schema.org and Merchant Center do, they are selling you the press release.
• Don't chase in-chat checkout unless you are eligible. If you are not on the approved platforms selling to US buyers, path one is a waitlist, not a project. Your energy belongs in path two, which is open today.
• Don't assume subscriptions will stay excluded. The protocols describe support for digital goods and subscriptions even though the live checkouts exclude them. Build your checkout so the restriction is a policy toggle, not an architecture limit.

The tools on the table

{/* MONETIZATION NOTE (not rendered): links below are official product pages, NOT affiliate links yet. Swap for affiliate links once approved into a program; never label these as affiliate links until the swap is real. For this topic the primary money path is freelance agentic-commerce integration leads via the /#contact CTA below, plus display ads on the traffic. */}

My verdict: what I would do, and why

If this were my store, I would ignore every waitlist and spend one
afternoon on path two. Guest checkout on, Link and Google Pay enabled,
schema.org markup validated, product feed accurate, robots.txt reviewed,
bot rules tuned to let signed agents through, dispute logging confirmed,
and then one real agent purchase with my own card to find the snags. That
is a day's work, most of it configuration, and it covers every agent that
can reach a normal website today - which is nearly all of them.

The condition that flips my answer: the day a channel you actually want -
a marketplace, an assistant with your buyers in it - opens merchant
onboarding with real volume behind it, join it that week. Until then, the
in-chat checkout story is somebody else's platform war, and your checkout
page is the territory you already control. An agent that can finish your
checkout is worth more than a protocol badge on a waitlist page. Fix the
finish line first.

Frequently asked questions

Can an AI agent buy from my store right now?

Yes, in most cases - but through your own checkout, not through a chat
window. Assistants like Meta's Muse, Amazon's Buy for Me, OpenAI's dots,
and Gemini's Task agent buy on merchants' own sites, paying through your
existing payment provider. In-chat checkouts inside ChatGPT, Google AI
Mode, and Perplexity are gated to approved platforms and US buyers.

What is the Agentic Commerce Protocol (ACP)?

ACP is the open standard co-developed by OpenAI and Stripe (open source,
Apache 2.0) that lets an AI agent talk to a merchant's backend: create a
checkout session, update it, and complete the purchase with a delegated
payment token. It can be implemented as a REST interface or as an MCP
server. Implementing it does not list your products anywhere - each AI
platform manages its own merchant onboarding.

What is the Universal Commerce Protocol (UCP)?

UCP is Google's and Shopify's answer to the same problem: an open
standard covering catalog search, cart, checkout, identity linking, and
order tracking, designed so platforms, agents, and businesses
interoperate through one protocol. Stripe joined its governing council in
April 2026. Google's AI Mode and Gemini checkouts run on it for approved
Merchant Center sellers.

Do I need to build anything new for agents to buy from my store?

Probably not. Nothing in the agent-on-your-site path requires a protocol
from you: what decides whether an agent finishes the purchase is your
existing checkout. Allow guest checkout, accept a wallet agents use
(Stripe Link, Google Pay), keep prices and availability as plain
structured data, and make sure your bot protection lets verified agents
through.

Who handles chargebacks when an AI agent makes a purchase?

You do. Visa's rulebook treats the registered agent provider as the
cardholder and holds the cardholder responsible for the agent's actions;
it forbids merchants from requiring buyers to waive dispute rights.
Stripe's seller terms keep disputes, refunds, and transaction fraud with
the seller. Worldpay's summary: no liability shift exists yet.

Can AI agents buy subscriptions or digital products?

Not through the in-chat checkouts - ChatGPT's rules allow physical goods
only, Google excludes subscriptions and most digital goods, and Shopify
excludes subscriptions from Copilot and Google AI Mode checkouts. The
agent-on-your-site path has no such restriction: an agent can buy a
subscription on your own checkout page exactly like a human can.

The three-paths framing, the in-chat program statuses, the agent
behaviors (Buy for Me, Muse, dots, Gemini Task agent, Chrome auto
browse), the subscription exclusions, the liability rules, and all
traffic and survey figures come from Okane Land's researched review
"Can an AI agent buy from you yet?" (published October 14, 2026, read
October 21), which quotes the programs' own pages, the protocol docs,
and the card networks' rulebooks. The Wix Symphony plus Link wallet
announcement is from Wix's GlobeNewswire release of October 15, 2026;
the PayPal plus Glance integration is from their October 15, 2026
press release as reported by PYMNTS. The three-gate structure of the
checklist (finishable checkout, discoverability, dispute protection)
is my own synthesis. Nothing here is based on a test purchase I ran -
item 9 of the checklist is the test I recommend you run yourself.

Want this done on your store instead of reading about it? I build
checkout and commerce integrations for a living - tell me about your
store and I will tell you honestly whether you need an
afternoon of configuration or something bigger.

If AI-driven discovery is the part that interests you, start with
how to get cited by ChatGPT and Perplexity
and my GEO tools comparison - being found is
the gate before being bought.