What is AP2? The Agent Payments Protocol, explained

What is AP2?

AP2 (Agent Payments Protocol) is an open standard launched by Google in September 2025 with more than 60 payments and tech partners, including Mastercard, American Express, PayPal, Adyen, and Coinbase. It defines how an AI agent proves it has permission to spend someone's money.

The simplest way to think about it: UCP is how an agent shops. AP2 is how an agent pays.

Today, every payment system assumes a human is pressing the "Pay" button. Your bank sees you log in, your card gets typed in by you, and if something goes wrong, there's a clear answer to "did you authorize this?" When an agent is the one clicking, that answer disappears. The merchant doesn't know if you really asked for this. The bank doesn't know if the agent went off script. And if you dispute the charge later, nobody can prove what you actually agreed to.

AP2 solves this by giving every agent purchase a paper trail: signed proof of what the person asked for, what the agent picked, and what got paid.

What AP2 actually covers

AP2 is built around "mandates." A mandate is a digitally signed note that can't be altered after the fact. Think of it as a signed permission slip. There are three of them, and each one captures a different moment of the purchase:

1. Intent Mandate: what the person asked for. "Buy me running shoes, size 11, under $150, sometime this week." This is signed up front, before the agent goes shopping, and it sets the limits the agent has to stay inside.

2. Cart Mandate: what the agent actually picked. The specific shoes, the specific store, the final price. When the person is present, they approve this cart themselves. When they're not, the agent can build it on its own as long as it fits inside the Intent Mandate.

3. Payment Mandate: what goes to the bank or card network. It tells them an agent was involved and carries the other two mandates as proof.

Put together, the three form a chain: what was asked, what was chosen, what was paid. If anyone ever asks "who approved this?", the answer is written down and signed.

AP2 also doesn't care how you pay. Cards, bank transfers, and stablecoins all work, and Google has said real-time payment systems like Brazil's PIX and India's UPI are on the roadmap.

Why AP2 is a real protocol, not just a schema

UCP is mostly about structure: everyone agrees on the same format so agents and stores can understand each other. AP2 is about trust, and that's the big difference.

A format tells you what a message looks like. A protocol like AP2 tells you whether you can believe it. Every mandate is signed, so if someone changes the price or swaps the product after the person approved it, the signature breaks and everyone can see it.

That matters most when things go wrong. Today, when a customer says "I didn't buy that," the bank and the merchant argue over screenshots and logs. With AP2, there's a signed record of exactly what the customer agreed to. It turns a he-said-she-said into something you can actually check.

The two are designed to work together. When an agent reaches checkout through UCP, it can hand off to AP2 for the part where money and permission are involved.

Who adopts AP2, and how

For most merchants, AP2 arrives through their payment provider, not their own engineering team. Companies like PayPal, Adyen, and Worldpay can accept AP2 mandates and translate them into the card and bank payments merchants already process. The merchant keeps its checkout as is.

Merchants that want more control can run their own shopping agent that talks AP2 directly. Etsy and Lowe's showed this kind of setup at launch.

The bigger shift happened in April 2026, when Google handed AP2 over to the FIDO Alliance, the same industry group behind passkeys. Mastercard contributed its own framework, Verifiable Intent, to the same effort, and Visa, American Express, PayPal, and Stripe joined in. AP2 is no longer "Google's protocol." It's becoming a shared industry standard, which is usually the moment banks and networks start taking something seriously.

Where Beltic fits in

AP2 proves that something was signed. It doesn't tell you whether you should say yes.

Think of it like a signed check. The signature tells the bank the check is real. It doesn't tell the bank whether the account was hacked, whether the amount makes sense for this customer, or whether the person who signed it was tricked into it. A signed mandate works the same way. "Buy whatever's needed for the office, up to $5,000" is a perfectly valid Intent Mandate. It's also a very wide door for an agent to walk through.

That's the gap Beltic fills. AP2 hands over the evidence. Beltic reads it and turns it into a decision.

Here's how it works in practice. An agent arrives with its AP2 mandates. Beltic looks at the Intent Mandate and asks whether the request is clear, how risky it is, and whether it looks like something this person would normally ask for. Then it checks the Cart and Payment against that intent: did the agent actually buy what it was asked to buy, or did "running shoes under $150" turn into three pairs and a jacket? It also looks at the agent itself and who is behind it. All of that becomes a clear risk read, and the bank, payment provider, or merchant applies its own rules: approve, decline, or ask the customer to confirm.

For banks and card issuers, the payoff is approving more agent payments with confidence instead of blocking them by default. For merchants, it's fewer chargebacks from customers who say "my agent did that, not me."

AP2 gives everyone a signed record of what was asked and what was paid. Beltic makes sure someone actually checks that the two match before the money moves.

This post is part of our series on agentic protocols. For how they all fit together, read What are agentic protocols? A plain-English guide.