AP2 / FIDO Alliance Agent Payments Protocol
An open-source cryptographic authorization standard governed by the FIDO Alliance that gives AI agents a verifiable, tamper-evident proof of human consent before they autonomously execute financial transactions.
Rail: Payment · Updated: 2026-06-05
What It Is
The FIDO (Fast IDentity Online) Alliance is an open industry consortium best known for developing Passkeys — the phishing-resistant authentication standard that is gradually replacing passwords across the web. Recognizing that traditional payment systems assume a human is physically present to authorize each transaction, the FIDO Alliance identified a critical security gap created by autonomous AI agents: how does a merchant, payment processor, or bank know that a human actually authorized a specific purchase when the agent is acting independently, possibly while the user is asleep?
To address this, Google donated its internally developed Agent Payments Protocol (AP2) — alongside Mastercard's complementary Verifiable Intent framework — to the FIDO Alliance in April 2026. Sixty organizations joined the announcement coalition, including Adyen, American Express, Coinbase, PayPal, Revolut, Forter, and Etsy. The protocol is open-source (Apache 2.0 license) and community-governed under FIDO's Agentic Authentication and Payments Technical Working Groups. As of June 2026, AP2 is in active development at version 0.2 — not yet formally ratified as a completed standard, but with early production adoptions underway.
A critical distinction: AP2 is not a payment execution layer. It is an authorization and trust layer that is entirely payment-method agnostic. It works equally well with traditional credit cards, bank transfers, or blockchain networks. Protocols like x402 (Coinbase) and MPP (Stripe/Tempo Labs) handle the actual movement of funds over HTTP. In a fully composed stack, AP2 provides the cryptographic proof of human consent — the "mandate" — while x402 or MPP handles the settlement. The two layers are complementary, not competing.
AP2 achieves its trust guarantee through Verifiable Digital Credentials called Mandates — tamper-evident, cryptographically signed objects. A Checkout Mandate captures exactly what the user authorized the agent to buy. A Payment Mandate defines exactly how the agent is allowed to pay: which cards, maximum spending limits, allowed merchants. During autonomous "Human Not Present" flows, these mandates transition from Open to Closed state, creating a non-repudiable audit log that proves the agent's actions strictly adhered to human-approved constraints. The strategic value of donating this to FIDO rather than keeping it proprietary is network effect: global payment infrastructure requires universal interoperability, and a standard controlled by a neutral standards body with 60+ member organizations achieves adoption far faster than any single vendor's proprietary protocol.
Note on naming: AP2 stands for "Agent Payments Protocol" — the "2" is not a version number but a naming convention aligning with its parent protocol Agent2Agent (A2A). The current release version is v0.2.
Real-World Example
A user sets up an AI shopping agent to secure limited concert tickets that go on sale at 3:00 AM while they sleep. Before sleeping, the user signs an AP2 Mandate using biometric authentication on their device, authorizing the agent to spend a maximum of $300 only at the designated ticketing merchant. At 3:00 AM, the agent navigates the ticketing API, secures the seat, and submits the cryptographically signed AP2 Checkout and Payment Mandates to the merchant. The payment processor (Adyen or Stripe) verifies the FIDO-backed signatures against the constraints, confirms irrefutable proof of the sleeping user's intent, and completes the transaction without triggering a fraud block. No human woke up. No password was shared. The agent had exactly the authority it was given — no more.
Related Terms
- x402 Protocol — payment execution layer that AP2 authorization can sit above
- Machine Payments Protocol (MPP) — another execution layer complementary to AP2
- Agent Wallet — the custody environment agents use when executing AP2-authorized payments
- Agent Identity — the identity layer that AP2 mandates cryptographically bind to
- Agentic AI — the systems AP2 provides authorization infrastructure for