If you take the payment

ACP and UCP argue about carts and capabilities. AP2 argues about proof: did the human actually authorize this charge? If you run a store, you probably wait for Stripe, Shopify, or your acquirer. If you build wallets or agents, you have to read the mandate spec.

What AP2 is

The Agent Payments Protocol is Google's payment-authorization spec. A mandate is a signed credential that says what the agent may buy, from whom, for how much. The merchant is supposed to verify a checkout mandate before completing. The credential provider verifies a payment mandate before releasing a token. Google announced it in September 2025 and donated it to the FIDO Alliance on 28 April 2026, with AP2 v0.2 on GitHub the same day. v0.2 adds Human Not Present: pre-authorized instructions so an agent can pay when you are not in the session, ticket drops and the like.

FIDO is the passkey people. Putting AP2 there is a bet that banks will trust a mandate the way they trust a WebAuthn assertion. That is not the same as "your Shopify checkout speaks AP2 tomorrow."

How this sits next to ACP and UCP

UCP can list payment handlers (Shop Pay, Google Pay in Shopify's examples). ACP had Stripe shared payment tokens for Instant Checkout. AP2 is the "prove the human allowed this" layer. You can imagine UCP for the cart and AP2 for the charge. You can also imagine a PSP doing both and never showing you a mandate JSON. For a mid-size Shopify shop, the second world is more likely in 2026.

What I would ask a processor

Do you verify AP2 checkout mandates, or is that on us? Is Human Not Present allowed on our MCC, and with what cap? Is Verifiable Intent (Mastercard, also parked at FIDO) an opt-in? If the answers are shrugs, you are not behind. The spec is public. The rails are not evenly shipped.

Cart protocols: ACP vs UCP. Spec: AP2 on GitHub.

September 2026. Do not implement AP2 by hand on a theme. Ask the people who already touch the card.