Skip to content

Payment protocol · checked 9 November 2026

Agent payment safety checks for Google AP2 (Agent Payments Protocol)

An open protocol that uses signed, chained mandates to prove what a user authorized an agent to buy and to pay.

What your agent needs to know about Google AP2 (Agent Payments Protocol)

When it counts as settled
AP2 does not define settlement itself. In the overview, the merchant or its payment processor routes the transaction to the issuer or network, the issuer approves, and a receipt goes to the credential provider. Finality is therefore the underlying rail's (card auth and capture, or the chain for crypto). Treat a payment as done when the receipt comes back, not when the mandate is signed.[2]
Fees
No fees are defined by the protocol on the pages read. Fees depend on the payment rail used. The initial version supports pull payments such as cards; the site lists e-wallets, push payments and digital currencies as roadmap.[1]
Stablecoins
Not defined by AP2 itself. The AP2 site lists Human Present and Human Not Present x402 samples that use the x402 protocol for payments, and Google's agentic-commerce GitHub organisation publishes an A2A x402 extension for on-chain payments between agents. Check the extension's version and the asset and network an x402 payment uses.[1],[6]

How agent payments go wrong on Google AP2 (Agent Payments Protocol)

  1. 1. Stolen Payment Mandate reused on another checkout

    A signed Payment Mandate could be attached to an unrelated checkout. The spec binds it with a transaction_id or reference, and closed mandates carry sd_hash tied to the open mandate. Verifiers must check these bindings and merchants must check checkout_hash against the latest checkout_jwt.[3]

  2. 2. Overlapping closed mandates against one open mandate

    A non-deterministic agent could sign more than one closed mandate for the same open mandate, risking a double spend. The spec says it should not do so unless it has received receipts rejecting earlier ones, and those receipts must be protected from the LLM. Let credential providers or processors reject overlaps.[3]

  3. 3. Open mandate constraints too loose

    Open payment mandates can carry amount range, cumulative budget, allowed payees, allowed instruments, recurrence and an execution date window. Omitting any of these widens what the agent can do. Set every constraint you can.[4]

  4. 4. Prompt-injected agent picks a bad purchase

    The security page assumes prompt injection cannot be fully prevented and treats LLMs and agents as potential attackers. The defense is constraint checks on the closed mandate, not trust in the model. Do not rely on the agent to self-limit.[3]

  5. 5. SDK and spec drift

    The repository says its PyPI package is not yet published and docs templates were unrendered on the pages read. Field names and structures may change between versions. Pin the version you build against and re-check mandate formats on upgrade.[5],[4]

Pre-flight checklist for a Google AP2 (Agent Payments Protocol) agent

  • Set payee, instrument, amount range and budget constraints on every open mandate.
  • Set an exp (the spec example uses one hour) and a not_after execution date.
  • Bind the payment mandate to its checkout through transaction_id or reference and verify checkout_hash.
  • Keep receipts and rejections outside the LLM's control before signing another closed mandate.
  • Verify the user's signature before releasing any credential.
  • Pin the AP2 SDK or spec version; do not assume field names are stable.

Run the checks now, free

The free tools run in your browser: nothing you type leaves your browser, and wallet reads go only to a public RPC.

  • The Wrong-Money Test

    Write down what happens when your agent pays the wrong amount, the wrong address or the wrong token on Google AP2 (Agent Payments Protocol), and see whether the answer holds up.

  • Agent Spend-Cap Stress Test

    Work out how much your agents can really move in one window once retries, parallel runs and per-key limits stack up.

Want a second pair of eyes on how your agent pays on Google AP2 (Agent Payments Protocol)? Book the free 48-hour integration review (opens Cal.com in a new tab).

Sources

  1. [1] AP2 (Agent Payments Protocol), AP2 project
  2. [2] AP2 overview, google-agentic-commerce/AP2
  3. [3] Security and privacy considerations, google-agentic-commerce/AP2
  4. [4] Payment mandate, google-agentic-commerce/AP2
  5. [5] google-agentic-commerce/AP2 repository, GitHub
  6. [6] A2A x402 extension, GitHub (google-agentic-commerce)

Checked against these sources on 9 November 2026. Networks change: confirm against the live docs before you rely on a number. This page is a checklist from public documentation. It is not a security audit, legal, compliance or investment advice.