Google’s agent-payment protocol goes neutral: AP2 v0.2 donated to FIDO
28 April 2026
What happened
Google released version 0.2 of the Agent Payments Protocol (AP2) and donated the protocol to the FIDO Alliance for community governance, with 60+ organisations involved — including Mastercard, American Express, PayPal, Adyen, Coinbase, Etsy, Forter, Intuit, JCB, Revolut, Salesforce, ServiceNow, UnionPay International and Worldpay. AP2 was first announced in September 2025. Version 0.2 adds two things that matter: “Human Not Present” payments, where an agent completes a pre-authorised purchase without the human on the call, within conditions set in advance (for example a brand and a price cap); and Verifiable Intent, a tamper-proof log of user-authorised agent actions, co-developed with Mastercard and also donated to FIDO.
What AP2 does, and does not do
AP2 authorises; it does not settle. It proves, with cryptographically signed mandates, that a buyer authorised an agent’s transaction: an Intent Mandate (what the agent may do), a Cart Mandate (the exact items and price), and a Payment Mandate (the signal to the network that an agent is involved). Payment processing itself belongs to payment processors, not to AP2. It is method-agnostic: cards today, with a roadmap including real-time bank transfers and digital currencies.
What it means for each party in the payments chain
Issuer. The issuer’s benefit is a standard way to verify that a payment was authorised by the buyer, not by a rogue agent. The Intent Mandate and Cart Mandate give the issuer a cryptographic trail — which matters when the issuer must decide whether to honour a dispute.
Acquirer. The acquirer’s benefit is interoperability: a merchant that accepts AP2 accepts any AP2-compliant agent, rather than integrating with each agent provider separately. The acquirer’s cost is the work of verifying mandates at scale.
Merchant. The merchant’s benefit is that it can accept agent payments from any AP2 agent without building a bespoke integration. The merchant’s risk is that it must trust the mandate — and the mandate’s validity depends on the agent provider’s implementation, not on the merchant’s own checks.
PSP. The PSP’s role is unchanged by AP2: AP2 authorises, it does not settle. The PSP still processes the payment, still handles the money movement, and still bears the settlement risk. AP2’s value to the PSP is that it reduces the fraud and dispute surface by making authorisation provable.
Card scheme. The scheme’s interest is that AP2 becomes the common authorisation layer for agent payments, so the scheme’s rules (Visa Core Rules, Mastercard Chargeback Guide) can reference a standard mandate format rather than each vendor’s proprietary proof.