Learn / Protocols and standards
Mastercard Agent Pay for merchants
Mastercard Agent Pay is Mastercard’s programme, announced on 29 April 2025, that lets registered and verified AI agents pay with Mastercard Agentic Tokens, which build on the tokenisation already used for contactless and card on file payments. A merchant meets it in two places: at the website, where Mastercard uses Web Bot Auth so an approved agent can be recognised, and at checkout, where the agent pays with a token through a normal card form.
Mastercard announced Agent Pay on 29 April 2025. Its release introduced Mastercard Agentic Tokens, said the programme would require trusted AI agents to be registered and verified before they could make payments for users, and named Microsoft as a collaborator, with IBM, Braintree and Checkout.com also mentioned.
Mastercard’s chief product officer, Jorn Lambert, said in the same release that the launch included new merchant interfaces to distinguish trusted agents from bad actors. That is the part a store owner should read closely, because it is the part that touches the store.
At the door: recognising an approved agent
Cloudflare said on 14 October 2025 that Mastercard was incorporating Web Bot Auth into Agent Pay so merchants could identify trusted agents. An approved agent signs its requests with a key registered with Mastercard, and a CDN that checks the signature can tell that agent from an anonymous bot. See Web Bot Auth for the definition.
Mastercard’s newsroom describes an Agent Pay Acceptance Framework, launched in October 2025, that requires agents to be registered and verified before any transaction can take place on its network. Its developer playbook on preparing for agentic commerce names Cloudflare as the partner providing verification at the edge.
At checkout: paying with a token
Mastercard’s developer documentation tells Agent Pay integrators to use Mastercard Virtual Card Tokens when completing guest checkouts where the merchant’s form is simple. After the shopper consents, the agent can request a one-time Dynamic Token Validation Code to fill the security code field.
The practical consequence is that the agent pays through the same card form your customers use. So the questions that decide whether it succeeds are about your checkout:
- Is there a guest path? See forced account creation.
- Can the payment step be reached without a script that fails to load? See payment step unreachable.
- Is there a CAPTCHA in the way? See CAPTCHA at checkout.
What Mastercard tells merchants to prepare
Mastercard’s developer playbook on preparing for agentic commerce, as of 13 October 2026, gives merchants advice that is notably not specific to Mastercard: keep product pages and search open to agents, offer guest checkout, avoid aggressive CAPTCHAs, add schema.org product data, and publish pricing, availability and shipping in machine readable form. It says scheme specific guidance may change as the networks publish more detailed specifications.
That list is close to the one in how to offer guest checkout for agents and the rest of the fix guides, which is the reassuring part: the work that readies a store for Agent Pay is the work that readies it for every other agent.
What to ask, and of whom
- Your payment provider: do you accept Mastercard agentic tokens, and can you show agent payments as their own channel?
- Your CDN or bot protection provider: do you verify Web Bot Auth signatures from agents registered with Mastercard, and what happens to a request that passes?
- Both: what evidence of the shopper’s consent is retained if a payment is disputed? See how agent payments actually settle.
Visa’s counterpart is covered in the Trusted Agent Protocol for merchants.
Questions
Do I need a new integration to accept Agent Pay?
Mastercard says merchants can verify approved agents without deploying new code, with verification done at the CDN through Web Bot Auth, and its developer documentation has agents completing guest checkouts through the merchant’s existing card form. Ask your payment provider and your CDN what they support rather than building anything first.
What is an agentic token?
A Mastercard payment token issued for an AI agent to use on the shopper’s behalf. Mastercard’s announcement describes it as building on proven tokenisation capabilities that already support contactless mobile payments and card on file.
How does the agent fill in my card form?
Mastercard’s developer documentation tells Agent Pay integrators to use Mastercard Virtual Card Tokens for guest checkouts where the merchant’s form is simple, and says a one-time Dynamic Token Validation Code may be requested to fill the security code field. To your checkout it looks like a card being typed in.
Does it work with Visa’s protocol?
They are separate programmes on a shared foundation. Cloudflare describes both Visa’s Trusted Agent Protocol and Mastercard Agent Pay as using Web Bot Auth to authenticate agents, so a CDN that verifies one kind of signature is most of the way to verifying the other.