The 7 Protocols Powering Agentic Commerce in 2026: A Developer's Map

If you're a developer building for agentic commerce right now, you're staring at an alphabet soup of protocols: ACP, UCP, MCP, A2A, AP2, TAP, x402. Each solves a different layer of the stack. None of them work alone. And the documentation assumes you already know which ones you need.

This post maps all seven protocols, explains how they compose into a working stack, and tells you which ones to implement first based on your use case.

---

The Protocol Stack (Big Picture)

Before diving into each protocol, here's how they layer together:

┌───────────────────────────────────────────────────────────┐
│  TRUST LAYER                                               │
│  Visa TAP (agent identity) · Mastercard Agentic Tokens     │
├───────────────────────────────────────────────────────────┤
│  PAYMENT LAYER                                             │
│  AP2 (fiat mandates) · x402 (crypto) · Stripe SPT          │
├───────────────────────────────────────────────────────────┤
│  COMMERCE LAYER                                            │
│  ACP (checkout) · UCP (full lifecycle)                      │
├───────────────────────────────────────────────────────────┤
│  AGENT INFRASTRUCTURE LAYER                                │
│  MCP (data & tools) · A2A (agent coordination)              │
└───────────────────────────────────────────────────────────┘

A typical agentic purchase flows bottom-up: MCP gives the agent product data, A2A coordinates between specialist agents, ACP or UCP handles checkout, AP2 or Stripe authorizes payment, and Visa TAP verifies agent identity for the merchant.

You don't need all seven. But you need to understand where each fits.

---

1. MCP — Model Context Protocol

The foundation. Everything else builds on this.

What Developers Should Know

MCP provides three primitives: Tools (functions agents can call), Resources (structured data agents can read), and Prompts (templates for interactions). In commerce, this means your product catalog becomes a Resource, your checkout flow becomes Tools (create_checkout, get_checkout, update_checkout, complete_checkout), and your shopping assistant prompt becomes a Prompt.

MCP is the de facto standard for tool-calling in agentic systems. If you build one protocol integration, start here. Both UCP and ACP have MCP bindings — meaning agents can discover and invoke your commerce capabilities through MCP without knowing they're talking to an ACP or UCP endpoint.

The critical design decision: MCP maintains stateful connections with capability negotiation. This means agents discover what your server offers at runtime, not at compile time. Your server declares tools, the agent decides which to use. This decoupling is why MCP scales to 10,000+ servers without breaking.

Commerce-Specific Example

A Shopify MCP server exposes tools like:

{
  "tools": [
    { "name": "search_products", "description": "Search product catalog by query" },
    { "name": "get_product_details", "description": "Get full details for a product SKU" },
    { "name": "check_inventory", "description": "Real-time inventory check" },
    { "name": "create_checkout", "description": "Start a checkout session" },
    { "name": "complete_checkout", "description": "Finalize purchase with payment" }
  ]
}

The agent calls tools/list, discovers what's available, and invokes the right tools based on the user's intent. No hardcoding.

---

2. A2A — Agent-to-Agent Protocol

How agents talk to each other without sharing their secrets.

What Developers Should Know

A2A matters when a single agent can't handle the entire commerce flow alone. Example: a shopping agent discovers products, but needs a logistics agent to check shipping availability and a payment agent to handle authorization. A2A lets these agents coordinate without any of them seeing the others' internal state.

The key concept is the Agent Card — a capability manifest that each agent publishes, declaring what it can do, how to authenticate, and what protocols it supports. Think of it like a business card for AI agents.

When You Need It

You need A2A if you're building a multi-agent system — for example, a shopping assistant that coordinates with a separate price comparison agent, inventory checker, and payment handler. If you're building a single-purpose merchant endpoint, you probably don't need A2A yet.

---

3. ACP — Agentic Commerce Protocol

The checkout protocol. OpenAI and Stripe's standard for the last mile of agentic commerce.

What Developers Should Know

ACP is deliberately simple: five REST endpoints that walk through a checkout lifecycle. If you've built any REST API, you can implement ACP in a week.

The five endpoints:

1. POST /checkout_sessions — Create a session with items + buyer info
2. GET /checkout_sessions/{id} — Poll current state
3. POST /checkout_sessions/{id} — Update items, address, fulfillment selection
4. POST /checkout_sessions/{id}/complete — Submit payment via SharedPaymentToken
5. POST /checkout_sessions/{id}/cancel — Abort

The state machine: not_ready_for_payment → ready_for_payment → completed (or canceled).

Critical detail: ACP requires HMAC-SHA256 request signing and Bearer token authentication on every call. The Idempotency-Key header is recommended for POST requests — and if you don't implement it, you'll create duplicate sessions when agents retry (this is exactly what killed OpenAI's Instant Checkout).

Payment is via Stripe's SharedPaymentToken — a single-use, time-bound, amount-scoped credential. The agent provisions it, sends it in the CompleteCheckoutRequest, and the merchant redeems it with Stripe. This prevents overcharging and replay attacks.

When You Need It

Implement ACP if your agent traffic comes from ChatGPT or other conversational AI assistants. It's the path of least resistance if you're already on Stripe.

---

4. UCP — Universal Commerce Protocol

The full-lifecycle protocol. Google and Shopify's standard for discovery through post-purchase.

What Developers Should Know

UCP is more ambitious than ACP. Where ACP handles checkout, UCP defines the entire commerce lifecycle as composable Capabilities (Checkout, Identity Linking, Order Management) with optional Extensions (Discounts, Fulfillment, AP2 Mandates).

The critical differentiator is dynamic discovery. Merchants publish a manifest at /.well-known/ucp that declares their capabilities, supported protocols, and payment handlers. Agents discover these at runtime — no hardcoded integration required.

UCP's checkout flow is similar to ACP's but with important differences:

• Full resource replacement — updates use PUT (replace entire checkout), not partial POST
• Escalation state — the requires_escalation state with continue_url handles cases where the agent must hand off to a human (age verification, complex configuration)
• Error severity — errors come with recoverable, requires_buyer_input, or terminal severity, giving agents explicit guidance on what to do next
• Post-purchase — UCP includes an Order capability with fulfillment events (shipped, delivered, returned), which ACP doesn't cover

UCP uses reverse-domain namespacing for extensions (dev.ucp.shopping.checkout, com.example.payments.installments). This means anyone can define custom extensions without central approval — enabling rapid innovation while maintaining interoperability.

When You Need It

Implement UCP if your agent traffic comes from Google surfaces (Search AI Mode, Gemini, Google Shopping) or if you need full lifecycle support (order tracking, returns, loyalty). If you're a Shopify merchant, UCP activation is essentially push-button.

---

5. AP2 — Agent Payments Protocol

The payment authorization layer. Cryptographic proof that the human approved the purchase.

What Developers Should Know

AP2 solves a fundamental question: when an agent says "charge this card," how does the merchant know the human actually approved it?

AP2 uses a three-tier mandate system:

1. Intent mandate — User pre-authorizes purchase rules: "Buy running shoes under $100 when they go on sale." Specifies price limits, timing, product constraints.
2. Cart mandate — The actual items, prices, and merchant. Signed by the user when they review and approve the specific purchase.
3. Fulfillment mandate — Tracks what was delivered. Creates an auditable record for dispute resolution.

Each mandate is cryptographically signed, preventing replay attacks where payment credentials from Merchant A are intercepted and reused at Merchant B.

When You Need It

AP2 is the payment layer for UCP. If you're implementing UCP, you'll interact with AP2 mandates during the complete_checkout step. If you're using ACP, Stripe's SharedPaymentToken handles payment authorization instead.

---

6. Visa TAP — Trusted Agent Protocol

"Is this really a legitimate AI agent, or a bot trying to steal credit cards?"

What Developers Should Know

TAP operates at the edge — before agent requests even hit your application. Akamai's behavioral intelligence analyzes request patterns, and Visa's agent registry verifies agent credentials. Merchants get a trust signal: "This is a verified agent acting on behalf of a verified customer."

The key value: you don't need to rebuild your fraud detection for agent traffic. TAP provides the verification layer so your existing fraud stack can make informed decisions. Without it, your fraud tools will flag 30%+ of legitimate agent transactions because they don't look like human browsing behavior.

TAP is designed for Visa's network of 175 million merchant locations worldwide. For most merchants, integration happens at the payment gateway level (Stripe, Adyen) rather than requiring direct implementation.

When You Need It

You need TAP (or a similar trust layer) the moment you accept real payments from agent-initiated transactions. During sandbox testing, you can skip it. In production, agent identity verification is critical for fraud prevention.

---

7. x402 — The Crypto-Native Payments Protocol

Machine-to-machine payments without human involvement.

What Developers Should Know

x402 is fundamentally different from the other protocols. It's not about shopping — it's about agents paying for services autonomously. When Agent A needs data from Agent B's API, Agent B returns HTTP 402 "Payment Required" with a price. Agent A sends a USDC payment, Agent B serves the response.

The protocol supports ERC-20 tokens (USDC, EURC) via EIP-3009 or Permit2. Free tier: 1,000 transactions/month, then $0.001/transaction.

When You Need It

x402 is relevant if you're building agent infrastructure where agents need to autonomously purchase data, compute, or services from other agents. It's less relevant for consumer-facing commerce (where AP2 and Stripe handle payments) but important for the agent-to-agent economy.

---

Bonus: Mastercard Agentic Tokens

Not a standalone protocol, but worth understanding. Mastercard built Agentic Tokens — dynamic digital credentials on top of their existing tokenization infrastructure (the same foundation as contactless payments). These tokens empower AI agents to transact using existing Mastercard rails.

Mastercard explicitly designed these to work across ACP, UCP, AP2, and A2A. Their Agent Toolkit is available via MCP servers, enabling AI assistants to access Mastercard's API documentation through Claude, Cursor, and GitHub Copilot.

Mastercard Agentic Tokens rolled out to all US cardholders by holiday 2025, with global expansion following.

---

The Decision Matrix: Which Protocols Do You Need?

---

Where This Is Going

The protocol landscape will consolidate. My predictions:

Within 12 months: MCP becomes universal infrastructure (it's already there). ACP and UCP develop interoperability layers — merchants implement one and adapters handle the other. AP2 becomes the standard fiat payment authorization for agent transactions.

Within 24 months: A "meta-protocol" emerges that abstracts ACP/UCP differences. Agent identity standards (TAP and equivalents) become required for production deployments. x402 or similar becomes standard for agent-to-agent micropayments.

The invariant: Merchants who test their protocol implementations will capture agent-driven revenue. Merchants who don't will lose sales they never knew existed.

---

Test your ACP and UCP endpoints before real agents hit them. Get your Agent Readiness Score

---

Sources

• ACP Official Specification
• UCP Official Site
• MCP Specification
• A2A Protocol
• AP2 Protocol
• Visa TAP Developer Docs
• x402 Protocol
• Mastercard Agent Pay
• Google Developers Blog — Under the Hood: UCP
• Stripe — Agentic Commerce
• Anthropic — MCP Announcement
• Google — A2A Announcement