What is an AP2 mandate (Agent Payments Protocol)?

If you run a store, the word "mandate" may sound like a direct debit authorization: the signed permission a customer gives so you can pull a payment from their bank account. An AP2 (Agent Payments Protocol) mandate is something else, though the idea is similar: a signed authorization that someone can show later. Here the one using it is an AI agent buying for a person, in what is called agentic commerce, and what it proves is that the person approved that cart and that payment. It matters to the store because it is the proof it has to check before charging, and the one that gets examined if the charge is disputed.

How it works

Google introduced mandates in September 2025 as tamper-proof, cryptographically signed digital contracts that serve as verifiable proof of a person's instructions. That announcement talked about three: an intent mandate, which captures what the person asks for; a cart mandate, which fixes the exact items and price; and a payment mandate, which ties the payment method to that cart.⁠^{[1]Google Cloud Blog (Stavan Parikh and Rao Surapaneni, September 16, 2025). Announcing Agent Payments Protocol (AP2)}

The current specification, v0.2, works with two:⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)}

• The checkout mandate gives the store cryptographic proof that the shopping agent is authorized to buy the order it put together.
• The payment mandate gives that proof to the store's credential provider, network and payment processor: the agent is authorized to pay for that specific order.

Each exists in two states. Open, when it holds the conditions the person sets before an order exists; closed, when it authorizes a specific transaction.⁠^{[3]AP2, official protocol site. Agent Payments Protocol (AP2)} Mandates are issued as SD-JWT, a credential format that lets you reveal only part of the data, and each one declares its type and version in a vct field, such as mandate.checkout.open.1. The specification asks whoever processes them to compare that exact string, version suffix included.⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)}

Who signs each one

It depends on whether the person is present.⁠^{[4]AP2, official protocol site. Flows}

The trusted surface is the screen where the person gives their consent, and the specification requires that it not be agentic: the agent itself cannot be the one that asks for and grants the permission. An open mandate also carries the agent's public key, so only that agent can use it.⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)}

How they are tied to the order

The store signs the order (a checkout JWT). The checkout mandate is bound to that order through a cryptographic hash, and the payment mandate is bound to the same order with the same hash.⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)} The practical result: a mandate signed for one cart is no good for another. If the agent swaps an item, the hash stops matching.

What an open mandate can limit

The conditions of an open mandate are constraints with names of their own. The checkout mandate has two:⁠^{[5]AP2, official protocol site. Checkout Mandate}

The payment mandate's cover money and time:⁠^{[6]AP2, official protocol site. Payment Mandate}

A closed payment mandate, by contrast, no longer talks about conditions but about facts: the transaction identifier (the order's hash), who is being paid, the amount with its currency as an ISO 4217 code and the payment method used.⁠^{[6]AP2, official protocol site. Payment Mandate}

In a store

A fictional example: a customer asks her agent to buy two packs of sencha tea at Example Tea, her usual shop, once they have stock again. Here is how the content of her open checkout mandate would look, simplified, with the specification's field names:⁠^{[5]AP2, official protocol site. Checkout Mandate}

{
  "vct": "mandate.checkout.open.1",
  "constraints": [
    {
      "type": "checkout.allowed_merchants",
      "allowed": [
        { "id": "example-tea", "name": "Example Tea", "website": "https://example-tea.com" }
      ]
    },
    {
      "type": "checkout.line_items",
      "items": [
        {
          "id": "line-1",
          "acceptable_items": [
            { "id": "SENCHA-100", "title": "Organic sencha green tea, 100 g" }
          ],
          "quantity": 2
        }
      ]
    }
  ]
}

When the agent gets to payment, the store makes two checks: that the closed mandate matches the current order and that the open mandate's constraints are met (here, that the store is Example Tea and that the cart holds two packs of that tea).⁠^{[4]AP2, official protocol site. Flows} If something does not fit, the store or the credential provider can return an unresolved-constraint error (unresolved_constraint) and force the customer to approve the purchase again: the flow without the person present becomes one with the person present.⁠^{[4]AP2, official protocol site. Flows}

How to check it

1. Look at the version of the mandates you receive. The vct field gives type and version, and the specification asks you to compare the exact string.⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)}
2. Read the constraints before accepting an order with the person absent. The checkout ones name stores and items; the payment ones, amounts, payees and dates.⁠^{[5]AP2, official protocol site. Checkout Mandate}⁠^{[6]AP2, official protocol site. Payment Mandate}
3. Check that the closed mandate matches the cart you are about to charge, recomputing the hash of the order you signed.⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)}
4. Keep the mandates and the receipts for every order. In a dispute, the specification asks you to recompute that hash and check that each receipt's reference matches the hash of the corresponding closed mandate.⁠^{[2]AP2, official protocol site. Agent Payments Protocol Specification (v0.2)}
5. Ask your platform and your gateway whether they verify AP2 mandates for you. For most stores, an intermediary will do that work, not their own code.

Related concept: delegated payments

Delegated payments are the general practice: an agent pays on behalf of a person with a permission limited in advance. The mandate is the way AP2 records that permission, as a signed record of what was authorized, for which order and within what limits.⁠^{[3]AP2, official protocol site. Agent Payments Protocol (AP2)} Other protocols delegate payment another way: the ACP (Agentic Commerce Protocol) does it with a single-use credential and a maximum amount, with no mandates. And purchase intent is what the open mandate turns into conditions that can be checked.

To keep going, the AP2 entry explains the whole protocol and the agentic commerce reading path orders the rest of the vocabulary.