Short answer
Identify the payment route before rebuilding checkout. Check provider and market support, cryptographic agent verification, authentication and dispute responsibility.
The answer in detail
Your existing checkout may already support the relevant AI-assisted purchase route. Establish where payment actually happens, ask the payment provider about supported delegated credentials and test security rules. “Agent-ready” does not automatically require rebuilding the storefront, and a successful pilot does not establish availability for every merchant or country.
The benchmark
The source records this European payment timeline. The provider announcements below were independently checked on October 29, 2026. They establish the reported events and initial scope, not subsequent universal availability.
| Date in 2026 | Announcement cited | Scope reported at the time |
|---|---|---|
| March 2 | Santander and Mastercard completed an end-to-end agent payment on real infrastructure | Controlled environment, no commercial rollout then |
| June 2 | Mastercard described network enablement and authenticated transactions at participating European institutions | Pilots |
| June 16 | Adyen announced Agentic with Meta payment compatibility | Initially US-operating businesses |
| July 2 | Visa described European agent purchases, including lastminute.com and Frasers, with participating issuers | Participating merchants, using payment passkeys |
An independent October 29 check of Stripe's shared-payment-token documentation found support described for the US, Canada and selected European countries including France. It still links preview service terms. This is broader than a France-only pilot story, but is not proof that your account, customer and integration qualify.
The rule
Distinguish three routes. An independent check of Shopify's English overview confirms that ChatGPT referrals use merchant checkout, while some other channels can use activated Shopify-powered direct checkout. Delegated payment credentials are a separate provider integration.
| Route | Payment location | Merchant responsibility |
|---|---|---|
| ChatGPT referral | Merchant checkout, in-app browser or new tab | Checkout compatibility and payment authentication |
| Eligible activated direct-checkout channel | Channel's Shopify-powered checkout | Channel configuration, terms and supported order behavior |
| Delegated token | Payment provider integration | Credential support, contract, limits and liability |
European PSD2 authentication rules remain relevant where applicable. The source's March 2026 Osborne Clarke analysis described no special blanket exemption just because an agent initiates payment. That does not mean every transaction requires a fresh biometric challenge: the provider must establish the applicable authentication treatment and any existing exemptions. Agent signatures, consumer authorization and payment authentication solve different problems.
The steps
- Ask the provider in writing. Which Mastercard Agent Pay or Visa Intelligent Commerce credentials are accepted, for which merchant and buyer countries, on which account, and from what date? The source found no definitive French Shopify Payments token page at its audit date; absence from that article is not evidence of permanent unavailability. Keep the provider's current answer.
- Test verified-agent handling. Visa's Trusted Agent Protocol, independently opened October 29, describes cryptographic request verification using RFC 9421. Ask the CDN or antifraud provider whether it actually validates signatures and how current rules treat them. Seeing
Signature-InputandSignatureheaders is not equivalent to verifying them, and Visa documentation does not prove the same mechanism covers every Mastercard integration. A valid agent identity is not blanket purchase authorization. - Require order attribution. The source cites Stripe identifying agent orders in transaction reporting; verify current account support. At a niche fragrance store, an October 2026 audit found isolated payment-pixel tracking that often lost the original session. Additional agent-attribution loss was only an unmeasured hypothesis. Reconcile orders and provider records rather than assuming browser analytics will fill the gap.
- Clarify disputes. Establish contractual responsibility when a customer contests a delegated purchase. Review token restrictions, evidence and the chargeback workflow.
- Align price and inventory. The source cites Stripe amount-limit behavior: a mismatch between authorized and charged totals can fail. Include the actual shipping/tax total when applicable. Sample five products against structured offer price and inventory using the catalog method. Forced account creation can obstruct both people and agents.
- Schedule a review. Standards and provider integrations continue to evolve. Revisit the provider contract, channel support, consent requirements and security tests within six months or after material changes. A standards initiative or a successful pilot is not a requirement to rebuild an otherwise working checkout.
The pitfall
Do not buy an “agent-ready checkout” without evidence from the target markets: production merchants, actual volume, supported payment path and a clear scope of work. Conversely, a broad bot rule can reject legitimate activity invisibly. Repeat the verified-request test after rule changes and use the agent-versus-bot measurement method.
What to tell your team
“Our provider has proposed delegated-token support next quarter. Before commissioning a checkout rebuild, we will confirm market eligibility, authentication and dispute handling, then test verified-agent requests. We estimate two days for this initial audit.” The timeline and effort are fictional, not a provider commitment.
