Agent Payments Protocol (AP2)

Type: full-code · Vendor: Google · Language: specification · License: Apache-2.0 · Status: active · Status in practice: emerging · First released: 2025

Links: homepage docs repo

Define an open protocol for agent-led payments built on signed mandates and verifiable digital credentials that bound spending and leave a cryptographic audit trail.

Description. The Agent Payments Protocol (AP2) is an open specification from Google, developed with the FIPA Alliance working groups, for payments initiated by AI agents. The user signs mandates that capture spending constraints up front so an agent can execute payments within those bounds. Mandates are expressed as verifiable digital credentials, which are tamper-evident, cryptographically signed objects. Each transaction produces a non-repudiable cryptographic audit trail to support dispute resolution.

Agent loop shape. The user signs a mandate that captures payment constraints such as budget and allowed instruments, the agent executes a transaction within those constraints, and the protocol records each step as a tamper-evident, cryptographically signed verifiable digital credential that forms a non-repudiable audit trail.

Primary use cases

authorizing agent-led payments within user-set spending bounds
issuing signed mandates as verifiable digital credentials
producing a non-repudiable audit trail for agent transactions

flowchart TD fw["Agent Payments Protocol (AP2)"] fw --> p1["Session-Scoped Payment Authorization (core)"] fw --> p2["Provenance Ledger (core)"] fw --> p3["Deontic Token Delegation (core)"] fw --> p4["Agent-Initiated Payment (first-class)"] fw --> p5["Model Context Protocol (supported)"]

Key concepts

Mandate → deontic-token-delegation (docs) — A signed credential that captures a specific authorization step in a purchase; AP2 chains them so each stage of intent, cart, and payment is independently verifiable.
Verifiable Digital Credential (VDC) → provenance-ledger (docs) — The tamper-evident, cryptographically signed object that every mandate is expressed as, built on the W3C Verifiable Credentials standard for portability and interoperability.
Checkout Mandate → session-scoped-payment-authorization (docs) — The user's cryptographically signed approval of the explicit goods being purchased and confirmation of the purchase, created at the point the cart is accepted.
Payment Mandate → agent-initiated-payment (docs) — The mandate that authorizes a payment against a specific instrument and is conveyed to the credential provider, networks, and merchant payment processor to complete the transaction.