Explainers

An agent reads a catalogue, picks something, asks for a firm price, pays and keeps the receipt. No human clicks through a cart, so anything that assumes a browser — a session cookie, a hidden form field, a checkbox — is in the way.

That forces four questions in order: can the agent find the product, can it get a firm price, can money move with limits, and can the merchant tell who is calling and on whose behalf. Most specs you will read answer exactly one of them.

403 Forbidden is today's default. Many large sites refuse automated requests outright — while building this site's reading list, the announcement pages of several household-name companies returned 403 to a plain fetch, so they could not be cited at all.

402 Payment Required is the other road: reserved since 1997, barely used, and now the basis of x402 and pay-per-crawl. Instead of refusing the agent, the server answers with machine-readable terms and lets it pay and retry.

The interesting part is that both are decisions about the same traffic. A site that answers 402 gets paid by agents; a site that answers 403 gets nothing, and stays invisible to the buyers that matter next.

ACP standardises the merchant side of a purchase: a product feed, a checkout session that quotes tax and totals, a delegated payment step, then orders and webhooks. It is an open spec with dated versions, published as OpenAPI and JSON Schema.

It is what sits behind buying inside a chat assistant: the assistant holds the conversation, the merchant keeps the cart and the order of record.

UCP covers the same ground as ACP — catalogue, cart, checkout, order lifecycle — with capability discovery up front and bindings for both REST and MCP. Shopify's agent surface is built on it.

Two open specs for one job is less wasteful than it sounds: a merchant can implement both, and reference servers exist for each. Read the conformance suites to see where they actually differ.

AP2 splits a purchase into three signed artefacts: an intent mandate (what the user asked for), a cart mandate (what the agent actually assembled) and a payment mandate (what is being charged). Each is verifiable after the fact.

That matters for disputes. When a card is charged by software, everyone involved needs to be able to show what the human authorised months later.

A server answers 402 with the price and how to pay; the client pays and repeats the request with proof. It suits machine-to-machine spending — an API call, a page, a dataset — where signing up for an account makes no sense.

Settlement is usually on-chain stablecoins, which is also the main objection to it. The pattern itself does not require crypto; the 402 handshake is the reusable part.

Two approaches keep showing up. A mandate is a signed statement of what the user authorised, checked at payment time. A scoped token is a credential minted for one merchant and one amount, useless anywhere else.

Both replace the thing that should worry you: an agent holding a reusable card number with no ceiling.

An agent signs its requests with a key the merchant can look up in a public directory, using HTTP message signatures. The merchant then knows which agent is calling, rather than inferring it from a string anyone can copy.

It is being standardised at the IETF, and it is the missing half of every payment spec: knowing who is spending is only useful if you know who is asking.

MCP is how a model reaches a tool or a data source — including a merchant's catalogue server. A2A is how two agents talk, for example a shopping agent negotiating with a merchant's agent.

Neither is a commerce protocol. Commerce arrives through them: ACP defines an MCP binding, UCP an MCP transport, and x402 has an A2A extension for agent-to-agent payment.

Before any of the payment work matters, an agent has to understand the catalogue: prices as integers, availability as a flag, identifiers that stay stable. schema.org markup and a plain JSON feed do most of this today.

This is the cheapest work on the list and the most neglected. A shop with a good feed and a boring checkout is more agent-ready than one with the reverse.