To sell inside ChatGPT’s Instant Checkout, a merchant implements the Agentic Commerce Protocol (ACP) — an open spec, currently in beta, that defines how an agent finds a product, builds a cart, and pays without the shopper leaving the chat. It isn’t one integration; it’s four separate pieces, at different levels of maturity. Here’s what’s actually required today, straight from the spec repository, and what’s still a proposal you shouldn’t build against yet.

Who’s behind it

ACP is maintained on GitHub at agentic-commerce-protocol/agentic-commerce-protocol, under an Apache 2.0 license. The repo’s maintainer list names three lead maintainers: OpenAI, Stripe, and, as of the version we read, Meta — a merchant deciding whether to invest engineering time is no longer betting on a single company’s roadmap. The spec uses date-based versioning: each release is a full snapshot (2025-09-29, 2025-12-12, 2026-01-16, 2026-01-30, 2026-04-17), and unreleased work develops in the open before being promoted into the next dated snapshot.

The two pieces you must implement

1. Checkout Sessions — the core. A REST API your server exposes: POST /checkout_sessions (create), POST /checkout_sessions/{id} (update), GET /checkout_sessions/{id} (retrieve), POST /checkout_sessions/{id}/complete, and POST /checkout_sessions/{id}/cancel. Your store stays the system of record for orders, tax and payment settlement — ChatGPT calls your endpoints and renders whatever authoritative cart state you return (RFC: Agentic Checkout). Every POST needs an Idempotency-Key; every request carries an API-Version header the server validates.

2. Delegate Payment — the one MUST-implement endpoint outside checkout. POST /agentic_commerce/delegate_payment tokenizes a payment credential into a single-use vault token, scoped by an Allowance (max amount, currency, expiry). Your existing PSP still authorizes and settles the charge — ACP never transfers raw card data to the agent (RFC: Delegate Payment). If you’d rather not route payment through a shared token at all, a second RFC defines seller-backed handlers — saved cards, gift cards, points, store credit — resolved entirely on your own backend with no PCI scope for the agent side (RFC: Seller-Backed Payment Handler).

Both of the above shipped in the 2026-04-17 release, the latest dated snapshot as of this writing, alongside a Feed API (POST /feeds, PATCH /feeds/{id}/products) merchants use to push catalog data to an agent-hosted feed rather than waiting to be scraped (Feed API spec).

What’s still a proposal, not a requirement

Two RFCs in the same repo carry Status: Proposal and Version: unreleased — don’t treat these as launch blockers yet:

  • Discovery — a /.well-known/acp.json document so an agent can check whether a domain supports ACP before it ever calls checkout (RFC: Discovery).
  • Product Feeds (full RFC) — a richer catalog surface for cross-merchant comparison, beyond the Feed API endpoints already released (RFC: Product Feeds).

Both are worth reading now and revisiting before their next dated release — neither is something a merchant needs live today.

FAQ

Do I need Stripe to sell on ChatGPT?

No. Stripe co-maintains the spec and is a reference payment service provider, but Delegate Payment is PSP-agnostic — the vault token flows to whichever processor you already use. If you’d rather not tokenize through a shared vault at all, the seller-backed handler pattern lets you resolve saved cards, gift cards or store credit entirely on your own backend.

What is a “checkout session” in ACP?

It’s the object both sides share for one purchase attempt: created with line items, updated as the buyer changes address or fulfillment, then completed with a payment method, which is the point your server creates the order. Your server remains authoritative — ChatGPT only renders the state your API returns.

Is ACP stable enough to build against?

The checkout, delegate-payment, delegate-authentication and feed endpoints are past proposal stage and shipped in the 2026-04-17 dated release; the overall protocol still carries a “Beta” status badge in its own README. Pin your integration to a dated API-Version and watch the changelog for the next snapshot rather than tracking unreleased/ directly.

Sources

ACP is the rail Google’s UCP doesn’t interoperate with — implementing it correctly gets you conformant, but whether an agent can actually carry a real cart through your specific catalog to a completed order is the separate, harder question AgentReady’s transaction checks are built to answer.