The Agent Commerce Protocol Map

Chapter 1How Many Agent Commerce Protocols Are There?

Five worth knowing, and they are not competitors in the way the coverage implies. They solve different layers of the same transaction: who the agent is, what it may spend, how the purchase is expressed, and how the money moves. Reading them as five answers to one question is the mistake that makes the landscape look chaotic.

Chapter 2What Does Each One Actually Solve?

ACP is how an assistant expresses a purchase to a merchant. It is published by Stripe and OpenAI under Apache 2.0 and it powered ChatGPT's Instant Checkout. That surface was withdrawn in early March 2026, which is worth stating in the same breath because it is the clearest illustration in this space that a protocol and a live surface are different things. ACP the specification is unaffected by the withdrawal of the product that used it.

UCP is the broadest of the five. Co-developed by Google and Shopify and published 11 January 2026 under Apache 2.0, it covers four stages: product discovery, capability negotiation, checkout, and post-purchase handoff. Its distribution is the argument for it, because it arrives through Google and Shopify simultaneously rather than needing a merchant to adopt it deliberately.

AP2 answers a different question: not how the purchase is expressed, but whether the agent had permission to make it. It uses verifiable credentials to carry a signed mandate, so a merchant can check that a human authorised this agent for this kind of spend. Announced by Google on 16 September 2025.

x402 revives the long-dormant HTTP 402 Payment Required status code so one machine can pay another inline, settled on-chain, without a checkout page or a stored card. Started by Coinbase with Cloudflare, and moved under Linux Foundation governance in April 2026. It is the one of the five aimed at agent-to-agent payment rather than agent-to-merchant.

TAP is Visa's answer to agent identity: letting a site tell a legitimate agent apart from a scraper, and letting an agent present who it is acting for. It launched on 14 October 2025 with Cloudflare, which matters because the edge is where identity has to be checked; a trust signal your CDN cannot read is a trust signal nothing enforces.

Chapter 3Who Governs Each One?

Governance tells you whether a protocol will still exist in two years, and it is the field most often misreported. Three of these five are controlled by the company that created them, one has moved to a neutral foundation, and one is a two-company collaboration.

No version number is quoted for UCP anywhere in this guide, deliberately. A date-based version string circulates for it and is repeated in secondary coverage. Both the Shopify engineering post and the UCP specification repository were read on 3 August 2026 and neither names a version. The announcement date, the co-development and the Apache 2.0 licence all check out; the version does not, so it is absent.

Chapter 4Which Are Live and Which Are Specifications?

This is the distinction that decides whether any of it affects you this quarter, and it is the one most protocol coverage skips. A published specification with no live implementation is a proposal.

The x402 volume figure, since a table cell is the wrong place for a number that needs a caveat: a public Dune dashboard read roughly 130 million lifetime transactions as of May 2026. That is on-chain and independently checkable by anyone, which is a stronger basis than a vendor press release, but it is a dashboard reading rather than an audited disclosure and it counts transactions rather than commerce. Treat it as evidence the protocol is in use, not as a measure of how much trade runs through it.

Chapter 5What Should a Merchant Do About Any of This?

Very little, directly, and that is the honest answer. Four of the five are infrastructure between platforms you do not operate. The one that reaches most merchants, UCP, reaches them through Shopify and Google without an integration decision. There is no protocol on this list that a DTC brand should be building against on its own initiative today.

What every one of them transmits, however, is your product data. That is the part you control and the part none of them improve. A protocol faithfully carrying a wrong price is a faster way to be wrong.

1. 1

   Ask your platform which it has already implemented

   Shopify merchants got UCP by default in the Winter 2026 Edition. This is a question with a real answer today and it costs one email. If the answer is that you already have it, the work is data quality rather than integration.

2. 2

   Fix the data every protocol will carry

   Server-rendered Product schema, complete attributes, accurate pricing and current availability. Price is the field most likely to be wrong in a way nobody notices, because the same endpoint can return dollars to one client and cents to another with nothing in the payload to distinguish them.

3. 3

   Check that an agent can reach you before worrying which one

   Six of the 72 DTC brands in our public registry answer every request with an error rather than a storefront. No protocol on this list resolves that; it is a rule at the edge. Registry figures read from our checked-in brand list on 3 August 2026.

4. 4

   Watch governance, not announcements

   A protocol moving to a neutral foundation, as x402 did in April 2026, tells you more about its durability than any number of launch partners. A protocol still controlled by one company is one strategy change away from being deprecated.