The state of agentic checkout

Last verified: 28 August 2026. Every claim below is sourced, and the source is named in the sentence that carries it. Where a widely repeated figure could not be confirmed against a primary source, it appears in the Contested section rather than in the body, and it is not restated as fact anywhere else on this page.

This page exists because the answer keeps moving. A merchant who read a confident article in December 2025 learned that purchases complete inside ChatGPT. A merchant who read one in April 2026 learned the opposite. Both were accurate on the day they were written and wrong within a quarter. A maintained page with a verification date is worth more than either.

Where a purchase completes today

ChatGPT: on your checkout

Retail Dive reported on 25 March 2026 that OpenAI had announced the previous day that it was retiring the first version of Instant Checkout, roughly six months after the 29 September 2025 launch, and that checkout was moving back to merchant sites. Retail Dive carried OpenAI’s statement: "the initial version of Instant Checkout did not offer the level of flexibility that we aspire to provide, so we’re allowing merchants to use their own checkout experiences while we focus our efforts on product discovery."

Shopify’s help centre describes what a merchant sees. ChatGPT users "complete their purchase on your online store checkout in a ChatGPT in-app browser, or in a new tab when customers use ChatGPT web". In practice that is your ordinary checkout, driven on a narrow mobile viewport, in a fresh session.

Google AI Mode, Gemini and Microsoft Copilot: inside the assistant

Shopify’s agentic storefronts documentation says shoppers on these channels complete their purchase "in the AI channel’s Shopify-powered direct checkout without having to leave their chat conversation". The same documentation describes the Google AI Mode and Gemini channels as early access and not yet available for all stores. Here your checkout is not the surface, but your product data still is: price, availability, variants and policies are what the assistant is reading.

Everywhere else: your ordinary storefront

Outside the named channels, an agent shops the way a person does. It loads pages, reads what it can parse, clicks what it can activate, and gives up when it cannot. This is the fallback under every protocol and the only path when no protocol applies, which is why an operable storefront outranks any protocol adoption on a list of things to fix.

What changed in 2026

• 11 January 2026. Google announced the Universal Commerce Protocol at NRF, built with Shopify, Etsy, Wayfair, Target and Walmart. Sundar Pichai’s remarks on Google’s company blog said more than twenty further companies had endorsed it. Google’s developer blog the same day described the shape: a manifest at /.well-known/ucp, capabilities for checkout, discovery, discount and fulfilment, and a relationship to AP2, A2A and MCP.
• 21 January 2026. PYMNTS reported a 4 percent OpenAI fee on Shopify sales made in ChatGPT, citing The Information citing a Shopify spokesperson. Shopify’s current help centre contradicts it. See Contested below.
• 19 March 2026. Google’s Shopping blog announced UCP additions: Cart, Catalog and Identity Linking over OAuth 2.0, plus onboarding through Merchant Center. Search Engine Journal noted that Cart and Catalog are draft specifications while Identity Linking is stable.
• 24 March 2026. OpenAI retired the first version of Instant Checkout, as reported by Retail Dive the following day. The same report listed seven retailers live on the updated Agentic Commerce Protocol: Target, Sephora, Nordstrom, Lowe’s, Best Buy, The Home Depot and Wayfair, with Walmart selling through Sparky.
• 17 April 2026. The Agentic Commerce Protocol repository, maintained by OpenAI and Stripe under Apache 2.0, published a revision adding cart, feed, orders, authentication and MCP.
• 7 May 2026. Shopify’s developer changelog said bots and agents should identify themselves via Web Bot Auth, and that unsigned bots receive the strictest rate limits on the Storefront API and on Shopify-hosted online store pages.
• 1 July 2026. Cloudflare published its AI traffic options, setting out the Search, Training and Agent categories and announcing a default change coming on 15 September 2026.

Contested

These are the claims a merchant will meet repeatedly and should not act on without checking. Keeping them here, rather than quietly omitting them, is the difference between a maintained page and a news summary.

The 4 percent OpenAI fee on Shopify sales in ChatGPT. PYMNTS reported it on 21 January 2026, citing The Information citing a Shopify spokesperson. Shopify’s current help centre says: "There are no fees associated with selling in ChatGPT. You pay only your standard payment processing fees." Two sources of good standing disagree, and the primary one is the platform’s own live documentation. Ottom does not state the 4 percent figure as fact. If your margin model depends on it, check the platform documentation on the day you build the model.

The launch date of Shopify’s Agentic plan. Trade press carries a specific date. Shopify’s own page for the plan does not, so no date is asserted here. What the page does say is verifiable and more useful: the plan has no monthly subscription cost, and you pay only when your products sell.

Who sits on the IETF Web Bot Auth working group. The working group is real and chartered to standardise cryptographic authentication of automated clients, with milestones for a standards-track document in April 2026 and a best current practice in August 2026, built on HTTP Message Signatures. Lists of participating companies circulate widely and the charter page does not confirm them, so no membership list appears here. Cloudflare’s involvement is stated only through its own published work: a blog post of 1 July 2025 describing acceptance of HTTP Message Signatures into its Verified Bots Program, with a key directory at /.well-known/http-message-signature-directory.

What changes next

• Cloudflare’s default change is upcoming, not history. Cloudflare said on 1 July 2026 that from 15 September 2026, for new domains onboarding to Cloudflare, Training and Agent bots will be blocked by default on pages that display ads, that Search stays allowed, and that customers can opt out in Security settings beforehand. The "pages that display ads" qualifier is load-bearing: most storefronts do not display ads, so most are not directly affected.
• Web Bot Auth is shipping ahead of its own standardisation. Shopify already tiers rate limits by whether a request is signed, and Cloudflare already accepts HTTP Message Signatures into its Verified Bots Program, while the IETF working group milestones run to August 2026. Expect practice to keep leading the document.
• UCP is not finished. Google’s 19 March 2026 update added Cart, Catalog and Identity Linking, and Search Engine Journal noted that Cart and Catalog are still draft specifications. Building against a draft is a decision with a maintenance cost attached.

What this means for a store owner

One position stayed correct through every change on this page: clean, machine-readable product data plus a checkout that can be operated without a mouse. That was the right answer when purchases completed inside ChatGPT, it was the right answer when they moved back to merchant checkouts, and it is the right answer under a protocol that has not shipped yet.

Everything else on this page is a reason to have someone watching, not a reason to rebuild. The stores that do well under agentic commerce are the ones whose data was already honest and whose checkout already worked for a keyboard.

How this page is maintained

It is rechecked monthly, and within a working week of any platform announcement that changes where a purchase completes. The verification date at the top is updated on every recheck whether or not anything changed, because "we looked and nothing moved" is information too. When a claim moves, the old version goes into the revision log rather than being silently overwritten.

Revision log

• 28 August 2026: first publication. Verified against OpenAI’s statement as carried by Retail Dive on 25 March 2026, Shopify’s agentic storefronts help centre, Google’s NRF 2026 remarks and UCP developer and Shopping blog posts, the Agentic Commerce Protocol repository, Google Cloud’s AP2 announcement, Shopify’s developer changelog on Web Bot Auth, Shopify’s Agentic plan page, Cloudflare’s AI traffic options post and Verified Bots blog, and the IETF Web Bot Auth working group charter.