Checkout Protocol
A checkout protocol is a defined set of technical rules governing how a purchase is processed on the internet — increasingly also when it is not a human but an AI program that initiates the purchase. It specifies how the shopping cart, price, delivery address, and payment are exchanged between the shop, the payment provider, and the buyer's side.
When you order something online, you eventually click “Buy.” What happens between the shop, your bank, and the payment service at that moment is a fixed sequence of messages. This exact sequence is called a checkout protocol: a kind of rulebook that determines which information is passed when and in what form. In technology, a protocol is nothing more than an agreement on how two programs communicate with each other. What’s new is that it’s no longer only humans pressing the buy button. Increasingly, a program handles the purchase on behalf of a user — and that requires a rulebook that also works without a clicking human.
The battle for the last mile of online retail
The moment of payment is the most valuable spot in online retail. Whoever controls it sees what is being bought and earns money on every transaction. Until now, this spot belonged to the shops themselves as well as providers like PayPal, Klarna, or Stripe. If purchasing decisions increasingly take place within a chat window, this position shifts.
That’s why a competition has emerged around checkout protocols, one that is regularly covered in business news. OpenAI, together with Stripe, has published the Agentic Commerce Protocol, while Google has introduced its own method called the Agent Payments Protocol. Both are openly documented so that as many merchants as possible can join in. Whoever sets the standard is the one everyone else ultimately follows.
For merchants, a lot is at stake. Anyone not connected simply won’t appear in the suggestions of an AI assistant. At the same time, some shops fear becoming interchangeable suppliers, since the customer may no longer even see the brand. This is reminiscent of the debate around Amazon Marketplace twenty years ago.
What is exchanged between assistant, shop, and bank
A checkout protocol describes several steps in a fixed sequence. First, the purchasing program asks the shop about availability, final price, and shipping costs. Then a shopping cart is created that both sides see identically. Only after that does payment follow, and finally the shop confirms the order.
The most sensitive point is payment. An AI assistant doesn’t receive a real credit card number. Instead, it receives a token — a kind of one-time key that is only valid for a specific amount at a specific merchant. Even if this key were stolen, it couldn’t be used to make a second purchase.
Then there’s the question of authorization. The protocol must prove to the shop that a real user stands behind the program, one who actually authorized this purchase. Common methods include digital signatures — that is, mathematically verified signatures — plus fixed limits such as a maximum amount per order. It’s important to draw a distinction here: the protocol only governs the process, not the purchasing decision. What gets bought is decided by the AI model beforehand; the protocol simply executes it cleanly.
When the assistant places the order
In everyday life, you first encounter this in chat assistants with shopping functionality. You describe what you’re looking for, get shown products, and can order directly within the chat without opening the shop. ChatGPT already offers this for selected merchants, with Shopify and Etsy among the first partners. Behind the scenes, exactly this kind of protocol is running.
A second area involves recurring orders within companies. Office supplies, spare parts, or consumables are automatically reordered once stock falls below a certain threshold. Here, the process mainly saves administrative effort.
A common misconception is that a checkout protocol makes the AI itself better or more reliable. It doesn’t. It only ensures that a decision already made is translated cleanly and traceably into an order. If the assistant orders the wrong product, even the best protocol won’t help — it merely guarantees that the process of reversing the order runs in an orderly fashion.
