Agent Payments Protocol (AP2): Cryptographic Trust for Agentic Transactions
AP2 is Google's cryptographic mandate framework for agentic commerce. Checkout and Payment mandates — signed with W3C Verifiable Credentials — give AI agents provable authority to purchase on behalf of users and create the non-repudiation audit trail enterprise procurement, legal compliance, and financial governance require. AP2 is the trust layer that makes AI spending legally defensible.
What is AP2?
Agent Payments Protocol (AP2) is Google's mandate framework for establishing cryptographically verifiable trust in AI-mediated transactions. Where UCP handles discovery and ACP handles checkout execution, AP2 answers the hardest question in agentic commerce: how do we prove an AI agent was authorized to make that purchase? AP2 answers with signed Verifiable Credentials that create a tamper-evident chain of authorization from user to agent to transaction.
AP2 operates through two types of cryptographic mandates. A Checkout Mandate is a transaction-specific authorization — it includes a cryptographic hash of the exact cart contents, binding the user's authorization to a specific set of items, prices, and a merchant. If any element of the cart changes, the hash verification fails and the transaction is blocked. A Payment Mandate is the cryptographic authorization that permits the AI agent to make payment for that checkout. It supports both live-signed Human-Present flows and pre-approved, autonomous Human-Not-Present flows (which define category, time, and spend boundaries for independent purchases).
Both mandate types are issued as W3C Verifiable Credentials (VCs) — the global standard for machine-verifiable digital credentials. AP2 supports JWT VC format for REST-compatible systems and LDP VC (Linked Data Proof) format for semantic interoperability. AP2 also integrates with the x402 crypto payment protocol, which extends the HTTP 402 status code into a machine-to-machine payment rail for crypto and CBDC payments — enabling AI agents to pay for API access and digital goods in stablecoin without traditional payment processors.
AP2 Mandate Types
Two levels of cryptographic authorization — one for discovery sessions, one for specific transactions. Both produce Verifiable Credential artifacts.
Checkout Mandate
Checkout AuthorizationA Checkout Mandate is a cryptographically bound authorization for one specific transaction. It includes a SHA-256 hash of the cart contents — every item, quantity, price, and merchant — making it tamper-evident. If anything in the cart changes between mandate issuance and checkout (price update, inventory change, item modification), the hash verification fails and the transaction is blocked. Checkout Mandates are the gold standard for enterprise purchase compliance because they create a document trail binding user intent to the exact transaction executed.
Scope
Transaction-specific
Validity
Up to 30 minutes
Use Case
Specific checkout execution
When issued
“When the agent has selected specific items and is ready to proceed to checkout: cart is defined, price is confirmed, merchant is known.”
VC credential claims
- Agent DID (authorized agent identity)
- Cart hash (SHA-256 of items + prices + merchant)
- Exact authorized amount
- Merchant identifier
- Payment rail (stripe_spt, x402, etc.)
- Short-lived expiry (anti-replay)
Payment Mandate
Payment AuthorizationA Payment Mandate grants the AI agent cryptographic authorization to make payment for a checkout. It supports both live-signed Human-Present flows and pre-approved, autonomous Human-Not-Present flows. For autonomous buying (Human-Not-Present), the user defines category constraints, spend limits, and a validity window, permitting the agent to settle transactions autonomously within those boundaries.
Scope
Payment authorization
Validity
Up to 24 hours (or per pre-approval)
Use Case
Transaction settlement & pre-approved buying
When issued
“When a user initiates or pre-authorizes a transaction flow: "Buy me SaaS tools under $100/month autonomously." The pre-approved Payment Mandate covers the session.”
VC credential claims
- Agent DID (identity of the authorized agent)
- Flow type (Human-Present / Human-Not-Present)
- Spend limits (for pre-approved flows)
- Validity window (start/expiry)
- Issuer signature (user or IDP)
AP2 Mandates Discovery File
The /.well-known/ap2/mandates.json discovery document declares your mandate infrastructure. Agents and enterprise procurement systems fetch this to understand your AP2 capabilities before requesting authorization.
{
// AP2 protocol version
"ap2_version": "0.2",
// Mandate endpoints — where agents go to get authorization
"mandate_endpoints": {
"payment_mandate": "/api/ap2/mandates/payment", // payment authorization
"checkout_mandate": "/api/ap2/mandates/checkout", // specific checkout authorization
"revoke": "/api/ap2/mandates/revoke", // mandate revocation
"verify": "/api/ap2/mandates/verify" // third-party mandate verification
},
// Credential formats supported
"credential_formats": ["JWT_VC", "LDP_VC"],
// Signing key discovery
"issuer_did": "did:web:www.acmecommerce.com",
"jwks_uri": "https://www.acmecommerce.com/.well-known/jwks.json",
// Supported payment rails for AP2-authorized transactions
"payment_rails": ["stripe_spt", "x402", "credit_card"],
// Payment Mandate policy defaults (Human-Not-Present flow)
"payment_mandate_defaults": {
"max_validity_hours": 24,
"max_spend_per_mandate": {
"amount": "500",
"currency": "USD"
},
"allowed_categories": ["software", "professional_services", "digital_goods"]
},
// Checkout Mandate policy
"checkout_mandate_policy": {
"hash_algorithm": "SHA-256",
"max_validity_minutes": 30, // checkout mandates expire quickly to prevent replay
"require_price_lock": true // price must match exactly at checkout
},
// Audit trail configuration
"audit": {
"log_all_verifications": true,
"retention_days": 2555, // 7 years for enterprise compliance
"export_endpoint": "/api/ap2/audit/export"
}
}Verifiable Credentials in AP2
AP2 mandates are issued as W3C Verifiable Credentials. Below is a real Checkout Mandate JWT VC showing the complete credential structure — header, payload, and proof.
// Example: JWT VC for a Checkout Mandate
{
// Standard JWT header
"alg": "ES256",
"typ": "JWT",
"kid": "did:web:merchant.com#key-1"
}
// JWT payload (decoded):
{
"@context": [
"https://www.w3.org/ns/credentials/v2"
],
"type": ["VerifiableCredential", "AP2CheckoutMandate"],
"id": "urn:uuid:f47ac10b-58cc-4372-a567-0e02b2c3d479",
"issuer": "did:web:merchant.com",
"issuanceDate": "2026-02-15T14:30:00Z",
"expirationDate": "2026-02-15T15:00:00Z", // 30-min window
"credentialSubject": {
"id": "did:key:z6MkrCD...AgentDID", // the agent being authorized
"mandateType": "checkout",
"authorizedBy": "did:key:z6MkpTU...UserDID",
"merchant": "acme-commerce",
"checkoutHash": "sha256:e3b0c44298fc1c...", // tamper-evident cart binding
"authorizedAmount": {
"amount": "149.99",
"currency": "USD"
},
"paymentRail": "stripe_spt",
"nonce": "abc123xyz" // replay attack prevention
},
"proof": {
"type": "JsonWebSignature2020",
"created": "2026-02-15T14:30:00Z",
"verificationMethod": "did:web:merchant.com#key-1",
"proofPurpose": "assertionMethod",
"jws": "eyJhbGciOiJFUzI1NiJ9...signature"
}
}JWT VC
JSON Web Token format. Best for REST APIs, Stripe integrations, and systems already using JWT-based auth. Compact, widely supported, easy to decode with standard JWT libraries.
alg: ES256 | RS256
typ: JWT
standard VC claimsLDP VC
Linked Data Proof format. Best for semantic web interoperability, enterprise DID-based identity systems, and cross-organization credential exchange. Supports Ed25519Signature2020 and BBS+ for selective disclosure.
proof.type: Ed25519Signature2020
@context: w3c/credentials/v1
JSON-LD expanded formatWhy Enterprises Need AP2
UCP and ACP make AI commerce possible. AP2 makes it compliant.
Procurement Compliance
Enterprise procurement policies require documented authorization for every purchase. AP2 Checkout and Payment Mandates serve as the machine-readable equivalent of a purchase order — signed by an authorized principal, scoped to a specific category or transaction, and verifiable by auditors without human attestation.
Legal Defensibility
When an AI agent makes a purchase, the question "who authorized this?" must have a cryptographically verifiable answer. AP2 Verifiable Credentials provide that answer: the VC proves which user authorized which agent to purchase what, signed with a key traceable to the user's identity. Courts and regulators accept cryptographic signatures as proof of authorization.
Non-Repudiation Audit Trails
AP2 mandates that every mandate issuance, presentation, and verification be logged with timestamp, agent identity, and cryptographic proof. The resulting audit trail is non-repudiable: neither the buyer's agent nor the merchant can claim a transaction did not occur or that different terms were agreed to. For financial close, SOX compliance, and dispute resolution, this trail is essential.
Spend Control and Delegation Governance
Enterprises grant employees spending authority within defined limits. AP2 extends this model to AI agents: finance controllers issue pre-approved Payment Mandates (Human-Not-Present flow) with category and amount constraints, employees cannot exceed their delegated budget, and every agent purchase is traced to the authorizing human. AP2 makes AI agent spending auditable under the same governance framework as corporate cards.
How to Implement AP2 Mandates
Five steps to full cryptographic trust infrastructure — from discovery file to non-repudiation audit trail.
Publish the AP2 mandates endpoint at /.well-known/ap2/mandates.json
Create /.well-known/ap2/mandates.json on your server. This discovery file declares your AP2 version, your mandate endpoint URLs, supported credential formats (JWT VC and/or LDP VC), and supported payment rails (card, x402). Serve it publicly with Content-Type: application/json. AI agents and enterprise procurement systems fetch this file to understand what authorization infrastructure you support before issuing mandates.
Implement Payment Mandate issuance and verification
Build the Payment Mandate API endpoint. When an AI agent or enterprise system requests payment authorization, issue a signed Payment Mandate VC containing the authorized agent DID, the flow type (Human-Present or Human-Not-Present), spending limits (if pre-approved), validity window, and issuer signature. Store a mandate ID and hash for audit trail purposes. On the receiving side, verify the VC signature, check expiry, confirm the payment limits are respected, and log the verification event.
Implement Checkout Mandate binding to specific checkouts
Build the Checkout Mandate API endpoint. Checkout Mandates bind authorization to a specific assembled cart: hash the cart contents (item IDs, quantities, prices, merchant ID), include that hash in the VC claims, and sign the credential. When an agent presents a Checkout Mandate at checkout, recompute the cart hash and verify it matches the checkout claim. Any cart modification — price change, quantity change, item swap — invalidates the mandate. This tamper-evidence is the foundation of non-repudiable transaction records.
Integrate Verifiable Credential issuance (JWT VC and LDP VC)
Choose your VC format based on your tech stack. JWT VC: issue standard JWTs with W3C VC claims using your signing key (RS256 or ES256). Include standard fields: @context, type, issuer, credentialSubject, expirationDate. Sign with your private key and return the signed token. LDP VC: issue JSON-LD credentials with a linked data proof (Ed25519Signature2020 or similar). For enterprise deployments, support both formats. Publish your public key at a DID document or JWKS endpoint so verifiers can validate signatures.
Build the non-repudiation audit trail
Every mandate issuance, presentation, verification, and checkout must be logged to an immutable audit store. Minimum fields: mandate_id, type (checkout/payment), agent_did, user_id, timestamp_utc, action (issued/verified/used/revoked), transaction_id if used at checkout, cart_hash if checkout mandate, outcome (success/failure/tampered). For enterprise compliance, write these logs to an append-only store (cloud audit log, blockchain anchor, or WORM storage). The audit trail is the legal record that proves what the AI agent was authorized to do and what it actually did.
AP2 Questions Answered
What is Agent Payments Protocol (AP2)?
Agent Payments Protocol (AP2) is Google's cryptographic mandate framework for agentic commerce transactions. It defines how users issue verifiable authorization mandates to AI agents — signed with W3C Verifiable Credentials — giving those agents cryptographically provable authority to purchase on their behalf. AP2 creates the non-repudiation audit trail that enterprise procurement, legal compliance, and financial governance require for AI-mediated spending.
What is the difference between an AP2 Checkout Mandate and a Payment Mandate?
A Checkout Mandate is a transaction-specific cryptographic proof that the user authorized a specific assembled cart (items, prices, and merchant) and is bound directly to those details. A Payment Mandate is the cryptographic proof authorizing payment for that checkout, supporting both live-signed Human-Present flows and pre-approved, autonomous Human-Not-Present flows. Both are signed Verifiable Credentials; Checkout Mandates include a cryptographic hash of the cart contents for tamper-evidence, while Payment Mandates verify that the funds can be settled under the agreed conditions.
What are Verifiable Credentials in the AP2 context?
In AP2, Verifiable Credentials (VCs) are W3C-standard signed digital documents that prove an AI agent has authorization to transact. Google's AP2 implementation supports two VC formats: JWT VC (JSON Web Token Verifiable Credential) for REST-compatible systems, and LDP VC (Linked Data Proof Verifiable Credential) for semantic interoperability. The credential is signed by the user's identity provider (or directly by the user's key) and includes claims about who authorized the agent, what they can purchase, and for how much.
What is the x402 payment protocol?
x402 is a crypto-native payment protocol that extends the HTTP 402 "Payment Required" status code into a machine-to-machine payment standard. In the AP2 context, x402 enables AI agents to pay for API access, digital content, and micro-transactions in stablecoin or CBDC without Stripe or traditional payment rails. The agent sends an x402 payment proof in the Authorization header; the server verifies the on-chain transaction before serving the resource. AP2 mandates can authorize x402 payments the same way they authorize card transactions.
Why do enterprises need AP2 beyond UCP and ACP?
UCP and ACP handle discovery and checkout — they make transactions possible. AP2 makes transactions legally defensible. Enterprise procurement requires: (1) documented proof that a human authorized each AI purchase category, (2) an immutable audit trail showing exactly what the agent bought and when, (3) cryptographic non-repudiation so neither the buyer nor the merchant can deny the transaction terms. AP2 mandates and VCs provide all three. Without AP2, AI agent purchases exist in a legal gray zone that procurement compliance, auditors, and finance controllers cannot accept.
Related Insights
AP2 Mandates: Cryptographic Trust
Technical deep dive into Checkout and Payment mandates, Verifiable Credentials, and the x402 payment protocol.
Agentic Commerce Protocols
How AP2 fits into the complete UCP/ACP/AP2 protocol stack for AI-mediated commerce.
Authority Flywheel
How AP2 trust infrastructure contributes to the authority flywheel that drives AI agent citation.
Build Cryptographic Trust for Your Agentic Transactions
Adam Silva Consulting implements the complete AP2 trust layer — mandate APIs, Verifiable Credential issuance, x402 payment integration, and enterprise audit trail infrastructure. Built alongside UCP discovery and ACP checkout for the complete agentic commerce stack.