Agent Payments ProtocolAP2

An open protocol that lets an artificial intelligence (AI) agent pay on a person's behalf while carrying signed proof of what the person approved, either the exact purchase or the limits for one the agent makes later on its own.

A person might tell an agent to buy two concert tickets under $150 each the moment they go on sale. AP2 signs that instruction, and the merchant and card issuer check the eventual purchase against it.

A specification that Google announced in September 2025 with more than 60 partner organizations, usable as an extension of the Agent2Agent protocol (A2A). In April 2026 Google donated AP2 to the FIDO Alliance, the industry body behind passkeys, and released version 0.2. FIDO working groups now develop it, so the text can still change.

AP2 secures payments with mandates, signed verifiable digital credentials that let the agent reveal only the details each party needs. Version 0.2 defines two mandate types, each in two states:

• Checkout mandate, which proves to the merchant that the agent may buy one specific cart the merchant signed.
• Payment mandate, which proves to the card issuer or wallet, network, and processor that the agent may pay for that cart with a given method.
• Open and closed states. An open mandate holds the person's limits, such as budget and allowed merchants, for one agent to use, and a closed mandate covers one transaction. A present person signs closed mandates; an absent person signs open ones in advance, and the agent signs closed ones within them.

The launch version used intent, cart, and payment mandates, which version 0.2 replaced. Signed receipts join the mandates as evidence for disputes.

AP2 sits next to terms that are easy to mix up:

• Agent mandate is the general idea of a person's scoped permission, and AP2 is one protocol that encodes it and sets out who checks it.
• Agentic payment protocols are the wider family of standards that AP2 belongs to.