ACP vs AP2 vs x402: Every Comparison You’ve Read Is Out of Date

• OpenAI launched Instant Checkout on 29 September 2025 and pulled it on 4 March 2026, taking ACP’s only consumer deployment with it. Roughly a dozen Shopify merchants had gone live, and the product never supported multi-item carts, promotional codes, or state sales tax remittance.
• The comparison nobody was running is the one that decided the market. Google and Shopify launched the Universal Commerce Protocol on 11 January 2026 with Etsy, Target, Walmart, and Wayfair behind it, which is largely the merchant roster ACP had been courting.
• AP2 went to the FIDO Alliance on 28 April 2026 and x402 went to the Linux Foundation on 14 July 2026, while ACP remains under founding-maintainer control at OpenAI and Stripe with a foundation still listed as a future path.
• x402 moved about $24 million across 75 million transactions in the 30 days to mid-July 2026, at an average of roughly 32 cents. Independent analysis attributes a large share of earlier volume to wash trading and meme-coin farming, and Visa clears x402’s best month in under a minute.
• None of the incumbents is choosing. Stripe, Google, Shopify, Adyen, Mastercard, Visa, and American Express appear across multiple specifications, and a single purchase can plausibly touch UCP for discovery, ACP or UCP for checkout, AP2 for authorization evidence, and x402 or a card rail for settlement.

Almost every comparison of agentic payment protocols still in circulation describes a world that stopped existing in March. The standard piece lines up the Agentic Commerce Protocol, the Agent Payments Protocol, and x402, gives each a column, and tells you to pick one based on transaction size and privacy needs. It was a reasonable framing in late 2025. It is now wrong on the two things that decide anything, because the protocol with the only real consumer deployment lost that deployment, and a fourth standard nobody was comparing quietly took the merchants.

OpenAI launched Instant Checkout on 29 September 2025 and pulled it on 4 March 2026, five months later. That product was ACP’s proof of life, the thing every comparison table pointed to under “deployments.” In the same window AP2 and x402 both handed themselves to neutral standards bodies, Google and Shopify shipped a fourth specification with the merchant roster to back it, and the same dozen companies turned up on the membership list of everything. Reading these as competitors that a merchant chooses between misses what the incumbents are doing, which is refusing to choose.

The five months that took out ACP’s flagship

What shipped in September was thinner than the coverage suggested. Instant Checkout supported single-item purchases from US Etsy sellers, with no multi-item carts, no promotional codes, no shipping promises, and no system in place for state sales tax remittance. Shopify president Harley Finkelstein said at an investor conference on the day of the retreat that roughly a dozen of Shopify’s millions of merchants had gone live, and that the holdup sat on the AI companies’ side rather than the merchant side. The reported take rate to OpenAI ranged between 2% and 4% depending on which secondhand account you read, and OpenAI never published the number in a primary post, which tells you something about how settled the commercial model was.

Buy bitcoin and stocks. Signup to Coinbase today

Jason Goldberg’s read on the retreat is the correct one and worth separating from the obituaries that followed. Consumers did not reject agentic checkout, because they were never offered a version complete enough to reject. What happened is that OpenAI’s applications org, run by someone who took Instacart public and understands exactly what a commerce stack costs, decided the engineering headcount was needed elsewhere while the company was simultaneously fighting model-quality wars, building hardware, and standing up an ads business. The counter-evidence sits with the vertical agents that own their own catalogs, where Amazon says Rufus has been used by more than 300 million customers and contributed close to $12 billion in incremental annualized sales, and Walmart reports that 50% of its mobile app users have tried Sparky with sessions producing 35% larger carts.

ACP itself did not die, and the specification history shows it moving rather than stalling. The public repo carries dated releases from 2025-09-29 through 2025-12-12 for fulfillment, 2026-01-16 for capability negotiation, 2026-01-30 for extensions and payment handlers, and 2026-04-17 for cart, feed, orders, authentication and MCP. That last release is ACP growing upward out of checkout and into discovery, the layer it now occupies inside ChatGPT. The protocol is still marked beta, still jointly governed by OpenAI and Stripe as founding maintainers, and still carries “neutral foundation stewardship as the ecosystem matures” as a stated future path rather than a completed one.

The dates in that release list repay a second look, because capability negotiation and an extension mechanism landed in ACP on 16 January and 30 January 2026, inside three weeks of a competing specification launching with negotiation and reverse-domain extensions as its central architectural claim. Both teams reached the same conclusion in the same month, that no single schema survives contact with real merchant complexity and the protocol has to let each side declare what it supports.

UCP took the merchants ACP was courting

The standard missing from most comparison pieces launched on 11 January 2026, when Google and Shopify published the Universal Commerce Protocol with support from Etsy, Target, Walmart, Wayfair, and Shopify’s merchant base. Those are largely the same merchants ACP had been courting since September, now standing behind a competing specification.

The design is architecturally more serious than ACP’s, and the difference is worth understanding before the branding. Merchants publish a capability profile at /.well-known/ucp, agents publish their own, and every request computes the intersection of what both sides support, which is the same negotiation HTTP already performs with accept headers. Extensions use reverse-domain naming, so a loyalty vendor defines com.loyaltyprovider.points without asking anyone’s permission, and the protocol evolves through namespace ownership rather than a committee vote. Capabilities version independently of the core schema, so adding delivery windows to fulfillment does not force a version bump on checkout.

But the part that reflects hard-won operational experience is the checkout state machine, because UCP assumes the agent will hit something it cannot handle and builds the exit ramp into the protocol. A checkout sits in incomplete, requires_escalation, or ready_for_complete, and when a transaction cannot proceed autonomously the merchant returns structured context plus a continue_url that hands the buyer back into an embedded checkout surface where they pick up exactly where the agent stopped. ACP was designed around the assumption that the agent completes the purchase. UCP is designed around the assumption that it frequently will not, which describes the last twelve months of evidence considerably better.

Payments in UCP work as a two-sided negotiation as well, with each provider publishing its own handler specification and merchants advertising which handlers they accept, so a regional PSP or a new wallet enters the ecosystem without a core version bump. That inverts the usual integration burden in a way that should worry anyone betting on a single-processor path.

AP2 is solving the problem that gates everything else

Google published the Agent Payments Protocol on 16 September 2025 with more than 60 organizations attached, including Adyen, American Express, Mastercard, PayPal, Worldpay, Coinbase, and Etsy. AP2 neither moves money nor builds carts, because its entire job is producing cryptographic evidence that a human authorized a specific thing.

Three verifiable credentials carry that evidence. A Cart Mandate is generated by the merchant, signed first by the merchant to commit to fulfilling the exact SKUs and price, then signed by the user with a hardware-backed device key, which means the buyer’s signature lands on a cart the merchant has already guaranteed. An Intent Mandate replaces it when the human is not present at transaction time, carrying price limits, timing conditions, a natural-language playback of what the agent believes it was told, and a time-to-live. The Payment Mandate is the narrow one shared with the network and issuer, and its purpose is to tell them an agent was involved and whether a human was present, so existing risk systems can reason about a transaction type they were never designed to see.

New Scam Prevention Course. Never make a rushed crypto decision again.

Privacy here rests on published standards, since selective disclosure of mandate contents uses SD-JWT, standardized as RFC 9901 in November 2025, including the decoy digests that stop a verifier from inferring how many claims were withheld. Mastercard introduced Verifiable Intent on 5 March 2026 on exactly that foundation, a protocol-agnostic trust layer co-developed with Google that binds cardholder identity, the original instruction, and the resulting purchase into one tamper-resistant record, aligned with both AP2 and UCP. Google then donated AP2 to the FIDO Alliance on 28 April 2026 alongside v0.2 and its Human Not Present flows, with Verifiable Intent going to FIDO in the same move.

Two limits in the specification get less attention than they deserve, starting with the liability allocation table in Section 6, the one that maps mispicks and account takeovers to responsible parties, carries an explicit disclaimer that it is a helpful guide and not a binding contract of any kind, because every payment network defines its own liability terms. And Section 9 openly lists what AP2 has not solved, including the issuance of trusted public keys, the root-of-trust problem the entire signature scheme depends on. Every mandate is verifiable against a public key, and the specification does not say who issues those keys or why anyone should trust them. Until that is answered by issuers, networks, or governments, the cryptographic chain terminates in an assumption.

The interim trust model is also more modest than the cryptography implies, since AP2 states that near-term trust between shopping agents, credential providers, and merchants runs on manually curated allowlists maintained by each party, with real-time trust establishment through discovery and verification standards left to the long term. So the protocol that exists to remove point-to-point integrations currently depends on each participant deciding by hand who it will talk to. That is a defensible bootstrap and a fair description of where the technology sits, and it should temper any reading of AP2 as a shipped solution to open agent identity.

x402 works exactly as advertised, and hardly anyone is buying anything with it

The Linux Foundation announced the operational launch of the x402 Foundation on 14 July 2026 with 40 member organizations and Coinbase’s contribution of the protocol complete. Premier members include Visa, Mastercard, American Express, Stripe, Adyen, Fiserv, Shopify, Google, AWS, Cloudflare, Circle, and Ripple. As governance goes, that is about as far from a crypto side project as a specification can get.

The mechanism is small, and its size is the main virtue. A server that wants payment answers with HTTP 402 and a price, the client signs a stablecoin transfer and resends the request with proof attached, and a facilitator verifies the payment on chain before the resource is served. No account, no card, no prior relationship, no underwriting. An autonomous agent cannot open a bank account or sign a SaaS contract, and payment processors reject merchants they cannot underwrite, which is the structural gap x402 fills rather than a performance complaint about card rails.

In March 2026 the protocol was processing roughly 131,000 transactions and about $28,000 in daily volume, with Artemis analysis finding that roughly half of observed transactions were artificial, split between self-dealing, where one wallet is both buyer and seller, and wash trading, where the seller funds the buyer’s wallet and the money comes straight back. The analyst’s phrase was that the boom was still mostly a mirage. Chainalysis reached a compatible conclusion from a different angle, finding that the surge past 100 million transactions on Base was driven in large part by PING, a pay-to-mint meme coin that required querying a URL, receiving a 402, and paying 1 USDC to mint, repeated hundreds of times per user on near-zero gas.

Growth since then is real and should be dated instead of dismissed, because by July the protocol was handling about 75 million transactions and $24 million over 30 days across roughly 94,000 buyers and 22,000 sellers, at an average payment of about 32 cents. Daily dollar volume grew something like twenty-fold in four months, which is a genuine trajectory. It is also $24 million a month against Visa’s $14.2 trillion in fiscal 2025, or roughly $40 billion a day, so x402’s best month clears in under a minute of Visa. Apply the wash-trading discount on top and the commercial base is smaller again.

What survives the discount still counts for something, since the average payment sits at 32 cents precisely because no card network can process that charge profitably, so the machine-to-machine thesis is doing what it was designed to do at a size traditional rails structurally cannot serve. Chainalysis also found the composition shifting, with transactions above $1 rising from 49% of volume in early 2025 to 95% by early 2026 while the 10 cents to $1 band collapsed from 46% to 4%, alongside a tester-to-payer conversion rate that improved fourfold in six months and weekly wallet retention drifting upward without a speculative catalyst behind it.

Behind those numbers sits a wallet profile that is both the least flattering and the most useful thing in the dataset, because x402 payers on Base average 197 days of wallet age against 423 for the rest of the chain, hold 26 different tokens against an average of 4, and have received roughly 12 times the capital inflows of a typical Base wallet. Read generously, that says people are creating and funding wallets specifically to transact through x402, so the protocol is pulling in new participants and not just recycling existing ones. Read plainly, it also says the user base is crypto-native, exploratory, and nothing like the enterprise buyer the 40-member foundation roster implies. The rail works as designed, and the economy it was built for has not shown up in any size yet.

The future of finance is here. Trade crypto and more

Four protocols, four owners, one membership list

The governance moves tell you more than any feature comparison, since AP2 went to FIDO, x402 went to the Linux Foundation, UCP sits with Google and Shopify behind a public spec and an open contribution path, and ACP remains under founding-maintainer control at OpenAI and Stripe with a foundation as a stated intention. Two of four handed the keys to a neutral body inside eighteen months of launch, which is fast by any standards-process measure and reflects how badly everyone wants to avoid the fragmentation that AP2’s own specification warns about in Section 1.3, where it describes merchants facing high development and maintenance costs across multiple non-standard integrations.

The membership rosters make nonsense of the competitive framing, though. Stripe co-maintains ACP and is a premier member of the x402 Foundation. Google owns AP2’s origin, co-developed UCP, and is a premier x402 member. Shopify co-developed UCP and is a premier x402 member. Adyen, Mastercard, and American Express appear across AP2’s launch partners and x402’s premier tier. Google wired the two together itself back in September 2025 by publishing an A2A x402 extension that carries stablecoin payments inside AP2’s mandate structure, with Coinbase, the Ethereum Foundation, and MetaMask involved.

None of these companies is betting on a winner, because they are buying options across every layer, and a single purchase can plausibly touch UCP for discovery and cart, ACP or UCP for checkout, AP2 for authorization evidence, and x402 or a card rail for settlement. The layers are complementary by construction, so choosing among them the way a merchant chooses a payment processor misreads what they are.

Liability is the open layer, and a card network moved first

Every one of these specifications produces evidence and none of them assigns loss. AP2 says so plainly. The protocols can prove a user signed a cart, prove the merchant committed to the price, and prove the agent stayed inside a budget, and they still leave open who pays when an agent buys the wrong concert tickets inside a valid mandate.

American Express answered on 14 April 2026 with its Agentic Commerce Experiences developer kit and Agent Purchase Protection, covering card members against registered agent errors. The conditions are the tell, because the agent must be registered with Amex, integrated through the ACE kit, and Amex must have received card-member-authenticated purchase intent before the transaction. That is a network taking a defined loss position in exchange for the evidence trail AP2-style mandates produce, and it converts a protocol feature into a commercial guarantee. Mastercard’s Verifiable Intent and Visa’s participation across both FIDO and the x402 Foundation point the same direction, which is that the networks intend to price and underwrite agentic risk rather than let the protocols define it.

Merchants should read that as the adoption gate, since cryptographic proof of intent earns its keep the day it becomes the evidence you file during representment and a network has already agreed what that evidence buys you.

What to do with this

Build the discovery layer first, because it is the only part with demonstrated demand. Structured product data, accurate real-time inventory and pricing, and a machine-readable capability profile pay off whether checkout happens in the agent surface or on your site, and the evidence from the past year says buyers research inside the chat window and complete the purchase somewhere they already trust. Instrument for agent-influenced revenue rather than agent-completed revenue, since the completed number will stay small for a while and will tell you almost nothing about whether agents are moving your sales.

On checkout, wait unless you are large enough that a platform is doing the integration for you. Protocol implementation, merchant program approval, and conformance testing run in months, and the specification you integrate against in Q3 is unlikely to be the one that consolidates. Sitting on Shopify or a large PSP means the protocol work happens above you anyway, which is the correct position while three of four specifications are still under eighteen months old and one has already lost its flagship product.

Take x402 seriously for one narrow case, meaning metered access to your own APIs and data by software you will never underwrite. That use case works today, sits at price points cards cannot serve, and does not require believing any forecast about trillions in agent-mediated commerce. McKinsey’s estimate that AI agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030 may prove right, and it has no bearing on whether metering an API by the call makes sense for you this quarter.

In crypto, one bad click is final. Learn to verify before you lose.

Calibrate the urgency against what buyers are telling their own investors. Instacart’s leadership has described its agentic efforts as not material and still very, very early, and fewer than 10% of the consumer packaged goods companies presenting at this year’s CAGNY conference mentioned agentic commerce at all. Forrester’s research continues to find that shoppers default to Amazon when it is time to buy. None of that argues the category fails, and all of it argues against reorganizing a commerce roadmap around a checkout flow that has not yet held together for a full year anywhere.

The protocols are converging considerably faster than the commerce is arriving, and nothing in the current data suggests that gap closes in the next twelve months.