Building for the Agentic Commerce Era

The 90 days from February through April 2026 reshaped agentic commerce in a way that should make any e-commerce engineer feel the playing field changed last quarter. On February 16, 2026 OpenAI publicly launched "Buy it in ChatGPT," opening Instant Checkout to all U.S. users including the free tier. On March 4, 2026 OpenAI quietly removed the in-chat checkout box and pivoted to ChatGPT Apps with merchant-controlled experiences. On April 24, 2026 Anthropic published Project Deal, an internal experiment that put four Claude variants into agent-to-agent negotiations and gave them an average fairness rating of 4 out of 7.

Sitting underneath those headlines, Google's Universal Commerce Protocol shipped in January 2026 with Walmart, Target, Shopify, and 20+ partners. Adobe Digital Insights tracked a 4,700% year-over-year increase in AI-driven traffic to retail sites by mid-2025. Shopify reported AI-attributed orders growing 11x between January 2025 and January 2026, and Shopify Sidekick crossed more than 5 million merchant conversations in 2025. The protocol layer, the traffic baseline, and the merchant tooling all moved at the same time.

This post is the engineering view. What the protocols actually do, how agents transact today, what to ship to be agent-ready by mid-2026, and how to instrument it so you can see what is breaking before your conversion rate tells you.

What actually happened in Q1 2026

Three things landed in sequence and engineering teams are still catching up.

On February 16, 2026, OpenAI publicly launched "Buy it in ChatGPT," making Instant Checkout available to all U.S. ChatGPT users including the free tier. Etsy was live at launch with all U.S. sellers automatically enrolled through the Offsite Ads program. Over a million Shopify merchants were in the onboarding pipeline. Brands including Glossier, SKIMS, Spanx, and Vuori were named early partners. The Agentic Commerce Protocol (ACP), built with Stripe, was open-sourced as the connective layer between merchants and ChatGPT. ChatGPT's 700-900 million weekly active users and roughly 50 million daily shopping queries became, in one announcement, the largest AI-native commerce surface on the planet.

On March 4, 2026, OpenAI quietly removed Instant Checkout. Only about 30 merchants were live; the experience was suffering from inaccurate pricing and inventory data pulled from web scraping. The new direction is ChatGPT Apps and dedicated merchant integrations. Walmart, for example, runs a mini-checkout inside the chat using its own payment systems and loyalty programs. The protocol still runs the underlying connection; the in-chat checkout box is no longer the canonical surface.

On April 24, 2026, Anthropic published Project Deal, an internal experiment where 69 employees used Claude-powered agents to negotiate purchases of items in a closed marketplace. Average fairness rating: 4 out of 7. Four different Claude variants were quietly assigned to participants. Anthropic framed it as a research experiment rather than a product, but the implications for agent-to-agent commerce are visible.

In parallel, Google's Universal Commerce Protocol (UCP) launched in January 2026 with Walmart, Target, Shopify, and 20+ partners. Mastercard rolled out Agent Pay, Visa rolled out AI-ready credentials, Stripe shipped the Shared Payment Token API for agent transactions without exposing card credentials. Adobe Digital Insights tracked a 4,700% year-over-year increase in AI-driven traffic to retail sites by mid-2025. Shopify reported AI-attributed orders growing 11x between January 2025 and January 2026.

McKinsey forecasts $3 to $5 trillion in global retail spend redirected through agentic commerce by 2030. Bain estimates 15 to 25% of total online retail flowing through agent channels by end of decade. Forrester predicts 20% of B2B sellers will face agent-led quote negotiations by end of 2026. These are not enthusiast projections, they are the research desks at the major firms.

For e-commerce engineering teams, the architectural implication is concrete: a meaningful share of your traffic in 2026 is not a human with a browser. It is an agent operating on behalf of a human, with very different needs, different failure modes, and different conversion mechanics. Building a site that converts well for human shoppers while also being legible to agents is the work of this year. The teams that get it right capture share from the teams that don't.

The remainder of this post covers the technical reality of agent traffic, the three patterns by which agents transact today, the protocol layer (ACP, UCP, MCP, Shopify Agentic Storefronts), and what to ship to be agent-ready by mid-2026.

How agents actually transact

Three architectural patterns describe how an AI agent buys something on behalf of a user. Each imposes different requirements on your site, and most merchants in 2026 will be exposed to all three at once.

Protocol-based transactions. The agent never visits your website. It exchanges structured data with your backend through a defined protocol (ACP for ChatGPT, UCP for Google's surface, custom integrations for closed marketplaces). The agent receives your product catalog, surfaces recommendations to the user, and when the user decides to buy, an order is placed via API. Payment runs through a tokenized flow (Stripe's Shared Payment Token, Mastercard Agent Pay, Visa's agentic credentials).

This is the cleanest pattern from an engineering standpoint. The traffic is API traffic, the conversion path is direct, and the merchant is the merchant of record. The hard parts are catalog freshness (your API has to return accurate pricing and inventory in real time) and onboarding (each protocol has its own integration work).

Browser-based agents. Tools like Perplexity's Comet open your website inside an AI-controlled browser, log in using saved credentials, and click through your checkout flow. The agent does not see your hero image, your discount popup, or your sponsored product placements. It parses the DOM, fills in fields, and submits. The agent navigates the site as a (very fast) shopper would.

This pattern works without any cooperation from the merchant. It is also the pattern that breaks the most. Modal popups, forced account creation, CAPTCHAs, slow-rendering product pages, inventory desync: every one of these is friction for a human and often a hard stop for an agent. Most e-commerce sites in 2026 are functionally hostile to browser-based agents without intending to be.

Hybrid app experiences. After OpenAI retreated from in-chat Instant Checkout in March 2026, the direction shifted to merchant-controlled experiences embedded in ChatGPT. Walmart runs a mini-storefront with its own checkout. Instacart, the first grocery partner from December 2025, runs its own grocery flow. The agent surfaces the merchant, the merchant runs the transaction. Loyalty, discounts, and brand experience stay with the merchant.

Most merchants in 2026 will be exposed to all three patterns simultaneously. ChatGPT users will reach you through ACP discovery and either complete in an app, click through to a Comet-style browser session, or visit the site directly. Google AI Mode users will reach you through UCP. Perplexity users may arrive through any of the three. Building for one pattern only means losing the other two.

How a single agent transaction flows

The end-to-end shape of one agent-driven order, from a customer agent triggering discovery through merchant settlement, is small enough to fit in a diagram.

The diagram makes one thing clear: every node is a place where the merchant either consents to the transaction or rejects it. Catalog freshness gates discovery, schema completeness gates protocol routing, the verification step gates whether the order even gets created, and attribution back to the agent is what closes the loop so the agent learns whether you converted.

The protocol layer

Four protocols define the interoperability story of 2026, and they overlap rather than compete cleanly.

The relationship between them, simplified:

• ACP and UCP are commerce-specific protocols. They define how an agent surfaces products, places orders, and routes payment. They compete for which AI surfaces use which.
• MCP, the data plumbing under Project Deal and most agent tooling, is general-purpose tool-calling infrastructure. It is the layer through which an agent connects to your product database, inventory system, CRM, and analytics in real time, regardless of which commerce protocol the transaction ultimately runs through. MCP crossed 97M+ monthly SDK downloads with 10,000+ active public servers by Q1 2026.
• Shopify Agentic Storefronts is a platform implementation of "implement once, serve all protocols." It is what merchants on Shopify get for free; merchants on custom stacks have to build it themselves.

The serious question for engineering teams is not "which protocol wins" but "how do we implement once and serve all four." The pattern that has emerged: a clean internal product API as the backbone, with thin protocol adapters that translate to ACP, UCP, MCP, and any future protocol.

A worked example: verifying an agent request

Most teams underestimate the verification step. An incoming POST to your /checkout endpoint that claims to be from a ChatGPT agent could be from a real ACP partner, a Comet browser session, a malicious bot, or a misconfigured staging environment. The verifier below (Python pseudocode, not a drop-in library) shows the minimum check: signature, token shape, and intent hash.

# Python pseudocode, for illustration only.
# Adapt to your payment processor and ACP / UCP partner SDKs in production.
 
import hmac, hashlib, time
from typing import Literal
 
ACP_PUBLIC_KEYS = {"openai-acp-2026": "<base64-pubkey>"}
UCP_PUBLIC_KEYS = {"google-ucp-2026": "<base64-pubkey>"}
MAX_CLOCK_SKEW_SEC = 300
 
def verify_agent_request(
    body: bytes,
    headers: dict,
    protocol: Literal["acp", "ucp"],
) -> dict:
    # 1. Signature: protocol partner signs every request with a rotating key.
    key_id = headers["x-agent-key-id"]
    sig = headers["x-agent-signature"]
    pubkey = (ACP_PUBLIC_KEYS if protocol == "acp" else UCP_PUBLIC_KEYS)[key_id]
    expected = hmac.new(pubkey.encode(), body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise PermissionError("bad signature")
 
    # 2. Replay protection: timestamp must be fresh.
    ts = int(headers["x-agent-timestamp"])
    if abs(time.time() - ts) > MAX_CLOCK_SKEW_SEC:
        raise PermissionError("stale request")
 
    # 3. Tokenized payment: never accept raw PAN, only Shared Payment Token.
    payload = parse_json(body)
    if not payload["payment"]["token"].startswith("spt_"):
        raise PermissionError("untokenized payment")
 
    # 4. Intent hash: agent commits to (sku, qty, price) before user confirms.
    intent = f"{payload['sku']}:{payload['qty']}:{payload['price_cents']}"
    if hashlib.sha256(intent.encode()).hexdigest() != payload["intent_hash"]:
        raise PermissionError("intent mismatch, possible price rewrite")
 
    return payload

In production, sign every response back to the agent with the same primitive, log the trace ID into your observability layer, and reject any request missing x-agent-protocol, x-agent-key-id, or a tokenized payment. Browser agents (Comet, Operator) do not use this path, they hit your normal checkout, so the verifier sits on the protocol endpoints only.

What agents need from your site

Whether the agent transacts through a protocol or through your live site, the requirements compress to a few core properties.

Real-time, accurate catalog access. A clean API that returns canonical fields (SKU, price, inventory, variants, shipping options, return policy) with low latency. The OpenAI ACP team and Google UCP team both define the schema, you do not need to invent your own. The practical test: a developer can query your site for the canonical price, stock level, and estimated ship date of any SKU in under 200ms with a single API call.

If you cannot do this, agents will skip you in favor of competitors who can. This is not a future problem, ChatGPT specifically deprioritized the original Instant Checkout merchants whose data was inaccurate.

Structured product data with rich attributes. NRF 2026 guidelines recommend titles of 30+ characters, descriptions of 500+ characters, GTIN always populated, minimum of 3 additional product images. Google's Shopping Graph and Shopify's Catalog API both ingest structured data, agents query against this rather than scraping HTML.

The shift this represents: traditional SEO optimized for ranking blog content, AI agents optimize for product feeds. A detailed article about your product category will not improve your ranking in a ChatGPT shopping result as much as a complete, accurate, real-time product feed will. Resource allocation should follow.

Crawler-friendly robots.txt. Several AI bots crawl differently. OAI-SearchBot powers ChatGPT search, ChatGPT-User is the live-fetch agent, PerplexityBot is Perplexity's. GPTBot is OpenAI's training crawler, anthropic-ai is Anthropic's. The distinction matters because retrieval crawlers drive live shopping results while training crawlers feed model updates. You may want to allow retrieval crawlers and block training crawlers, or both, but you need to know what your robots.txt actually does.

Shopify added default scraping restrictions in 2025; merchants who did not check their configuration discovered their stores were invisible to retrieval bots. Confirm yourstore.com/robots.txt explicitly.

Agent-friendly checkout flows. Forced account creation, CAPTCHAs, multi-page checkouts with JavaScript-heavy modals: each is a hard stop for browser-based agents. The fix is the same fix that helps human conversion: guest checkout, fewer steps, accurate inventory, fast pages. Building for agents and building for humans are the same engineering investment.

Identity, authorization, and payment plumbing. The user delegates buying authority to the agent. The agent needs to authenticate to the merchant somehow. Stripe's Shared Payment Token, Mastercard Agent Pay, and Visa's AI-ready credentials all solve a piece of this. The merchant accepts the agent's tokenized authorization, verifies it represents the user's intent, and processes the transaction without ever seeing raw card details.

The trust model is still settling. Most current implementations use the merchant's existing payment processor (Stripe, Adyen, etc.) with new token types layered on top. Building for agentic payments is mostly checkbox configuration if your payment processor supports it; the bigger work is on the user-side identity and consent flow that authorizes the agent in the first place.

Where engineering teams typically miss

Patterns that show up across e-commerce teams approaching agentic commerce in 2025 and 2026.

Treating agents like SEO traffic. A team adds schema markup and assumes that handles AI traffic. Schema markup helps with discovery, it does not help with transaction. Agents that try to actually buy something hit a checkout flow designed for humans and fail.

Optimizing for one protocol and losing the others. A team integrates with ACP for ChatGPT and ignores UCP. Six months later their Google AI Mode traffic is invisible to them. The protocols are competitive but the customers are additive, missing one means missing meaningful share.

Catalog freshness is broken. The team has a catalog API but it pulls from a database that updates nightly from the warehouse system. Agents querying for live inventory see stale data, orders placed by agents fail or ship from out-of-stock SKUs. The fix is real-time inventory sync, which is plumbing work.

No agent traffic instrumentation. The team's analytics conflates agent traffic with human traffic. They cannot tell what fraction of pageviews or revenue comes from agents, which agent platforms drive which traffic, or which products perform well in agent recommendations. Without this, optimization is guesswork.

Brand voice and loyalty disconnect. A merchant's careful brand experience is mediated by an agent that summarizes, paraphrases, and ranks. Brand-voice work that lives only in beautifully designed product pages does not survive into agent surfaces. The brand has to live in the structured data and the post-purchase experience.

Hostile checkout for browser agents. Forced login, CAPTCHA, modal popups for newsletter signup, JavaScript-heavy checkout flows that take 5 seconds to render. Each is a conversion problem for humans and a deal-breaker for agents. The investment in fixing this pays off twice.

What the next twelve months look like

Several trends to plan around.

Format war stays open. ACP and UCP coexist. ChatGPT and Google AI Mode capture different audiences and different intent shapes. Brands need to support both, in parallel, indefinitely.

ChatGPT Apps mature. The pivot from in-chat checkout to ChatGPT Apps creates a new surface for merchants to control their own experience inside the chat. Walmart and Instacart are the early references. More categories will get app experiences through 2026.

Agent-to-agent negotiation moves from research to pilot. Anthropic's Project Deal is a research experiment, but the technical pieces are ready. Agent-to-agent negotiation in B2B contexts (sourcing, procurement) is plausible by end of 2026. Forrester's projection that 20% of B2B sellers face agent-led negotiation by end of 2026 reflects this.

Amazon's wall holds, sort of. Amazon's $50 billion investment in OpenAI in February 2026 redirects ChatGPT's commerce partnerships. Amazon's lawsuit against Perplexity, filed November 2025, seeks to keep agents off its platform. The combined effect: Amazon is selectively present in agent surfaces it controls or partners with, and absent from the rest. Non-Amazon brands have a structural advantage in protocols where Amazon is blocked.

Mastercard Agent Pay and Visa agentic credentials become standard. The payment networks are racing to define the agent-authorization layer. By end of 2026, expect agent-tokenized payment to be a standard option across major processors.

Conversion attribution gets harder. Click-based attribution does not work when there are no clicks. Server-side tracking, ACP/UCP attribution APIs, and AI-attributed order tagging in the merchant ATS become critical. Klaviyo and similar marketing platforms are racing to build attribution dashboards for agent traffic.

Brand discoverability shifts to product data. GEO (Generative Engine Optimization) replaces a portion of SEO budget. The work is feed hygiene, schema markup, structured attributes, and crawler permission management. Less editorial volume, more operational rigor.

Build order

Agentic commerce stacks fail from the bottom up. Protocol adapters cannot be evaluated until the catalog API is fresh, and attribution cannot be evaluated until the protocol adapters are returning real orders. Build in dependency order, and gate each layer on a measurable check before moving up.

After the core sequence, layer on ChatGPT Apps experiences for high-volume channels and agent-specific A/B testing where traffic supports it. Skip the order and the failures cascade: a protocol adapter on top of a stale catalog ships wrong prices to ChatGPT, an attribution layer on top of a hostile checkout measures noise, and the teams waiting for the protocols to settle miss the window because the protocols will not settle, they will multiply.

How Respan fits

Agentic commerce is a distributed system where ChatGPT, Comet, Google AI Mode, and your catalog API negotiate transactions through ACP, UCP, and MCP. Respan is the observability and control plane underneath, so when an agent surfaces a product, places an order, or fails at checkout, you can see exactly what happened and ship a fix.

• Tracing: every agent commerce interaction captured as one connected trace, from ACP catalog query through tokenized payment authorization. Auto-instrumented for LangChain, LlamaIndex, Vercel AI SDK, CrewAI, AutoGen, OpenAI Agents SDK. When a Comet session abandons checkout or a ChatGPT order ships from out-of-stock inventory, the trace shows which protocol, which SKU, and which step broke.
• Evals: ten built-in evaluators (faithfulness, citation accuracy, refusal correctness, harmfulness) plus LLM-as-judge and custom Python evaluators. Production traffic flows directly into datasets. CI-aware experiments block regressions on stale catalog responses, hallucinated return policies, and incorrect agent-to-merchant order routing before deploys ship.
• Gateway: 500+ models behind an OpenAI-compatible interface, semantic caching, fallback chains, per-customer spending caps. Route the LLM calls inside your agent-facing endpoints (recommendation summaries, product Q&A, post-purchase support) through the gateway so you can swap models, cap spend per ACP partner, and survive provider outages without breaking agent traffic.
• Prompt management: versioned registry, dev/staging/prod environments with approval workflows, A/B testing in production with one-click rollback. Product-description generators, agent-facing FAQ responders, and any prompt that shapes how your catalog is summarized to ChatGPT, Google AI Mode, or Perplexity belongs in the registry.
• Monitors and alerts: catalog API latency above 200ms, inventory or price drift between source-of-truth and ACP/UCP responses, agent-traffic conversion rate by protocol, browser-agent checkout drop-off, AI-attributed order tagging gaps. Slack, email, PagerDuty, webhook. The same alerts that protect your protocol integrations also protect your Stripe Shared Payment Token flows.

A reasonable starter loop for agentic commerce builders:

1. Instrument every LLM call with Respan tracing including ACP catalog responses, UCP order placements, MCP tool invocations, and browser-agent session spans.
2. Pull 200 to 500 production agent orders and recommendation queries into a dataset and label them for catalog accuracy, schema completeness, and checkout completion.
3. Wire two or three evaluators that catch the failure modes you most fear (stale inventory or pricing, hostile checkout breaking browser agents like Comet, and protocol routing errors that send orders to the wrong fulfillment path).
4. Put your product-description, agent-FAQ, and recommendation-summary prompts behind the registry so you can version, A/B, and roll back without a deploy.
5. Route through the gateway so model swaps, fallbacks, and per-partner spending caps do not require changes to the ACP, UCP, or MCP adapters you already shipped.

If you skip this, agent traffic looks identical to human traffic in your dashboards, broken orders look like random noise, and the McKinsey $3 to $5 trillion of agentic spend redirects to competitors who can prove their catalog is fresh and their checkout is agent-friendly.

To wire any of the patterns above on Respan, start tracing for free, read the docs, or talk to us.

Related reading

• Evaluating LLM-Powered Product Search: the relevance and personalization layer
• LLM Customer Service in E-commerce: hallucinated policies, return fraud, and trust
• Building an AI Shopping Assistant: full architecture walkthrough
• How E-commerce Teams Build LLM Apps in 2026: pillar overview