Visa TAP, Google AP2, and FIDO: The Agent Authentication Standards Reshaping Commerce in 2026

For most of e-commerce history, a transaction had a human at one end of it. The human authenticated — with a password, a fingerprint, a one-time code — and that authentication was how the payment network knew the purchase was legitimate. Now that AI agents are initiating purchases on behalf of users, that model has a structural gap: the human authenticated their agent at setup time, but the merchant receiving the order has no reliable way to verify that the agent acting now is the same one the user authorized, that it hasn’t been hijacked or spoofed, or that it’s acting within its original scope.

That gap is what three competing standards are racing to close. Visa’s Trusted Agent Protocol (TAP), Google’s Agent Pay Protocol (AP2), and the FIDO Alliance’s Agentic Authentication Working Group are each approaching agent identity from a different technical angle — and the fragmentation has real consequences for any business that wants to accept agent-initiated orders without taking on the fraud and liability risk of being unable to verify who (or what) is placing them.

This post breaks down how each standard works, where they agree and disagree, and what merchants and commerce sites should be doing right now — before the standard that wins locks in requirements they haven’t planned for.

Why Agent Authentication Is a Different Problem Than Bot Detection

It’s worth being precise about what these standards are solving, because it’s easy to conflate agent authentication with the bot detection problem that QAIL’s research into 30M+ website visits illuminated. Bot detection — identifying whether a visitor is an automated agent or a human — is a traffic integrity problem. Agent authentication is a transaction integrity problem.

When an AI shopping agent visits your product page to compare options, you want to know it’s a legitimate crawler and not a scraper or a competitor’s reconnaissance bot. That’s the bot detection problem, and it’s largely about traffic signals, behavioral analysis, and access policy.

When that same agent proceeds to place an order, the problem is different. You now need to know: Is this agent cryptographically who it claims to be? Is it authorized by an actual human with a verified payment method? Is it acting within the scope the human granted — buying one item, not a hundred? Has that authorization been revoked since it was issued?

These are identity and authorization questions, not traffic questions. They require the agent to present proof, and they require infrastructure on the merchant’s side to verify that proof. That infrastructure is what the competing standards define — differently.

Visa TAP: Signed HTTP Messages at the Edge

Visa’s Trusted Agent Protocol, announced in October 2025, is the most commercially deployed of the three. By early 2026, TAP had attracted over 100 partners, with 30+ in sandbox testing and 20+ in active production integration. The mechanism is built on RFC 9421 — the IETF’s HTTP Message Signatures standard — combined with Ed25519 cryptographic signatures.

The mechanics work like this: when an agent initiates a purchase, it adds a cryptographically signed header to the HTTP request. That header includes the agent’s identity, a reference to the user’s authorization (scoped to a specific spending mandate), and the request details. The signature is generated with a private key registered in Visa’s directory of agent public keys. The merchant verifies the signature against Visa’s directory before processing.

In December 2025, Visa partnered with Akamai to push TAP verification to the CDN edge — meaning the signature check happens before the request reaches the merchant’s origin server, eliminating a class of attacks where fraudulent requests consume backend resources even if they ultimately fail verification.

TAP’s practical strength is that it integrates with existing payment infrastructure. Merchants already process Visa transactions; adding TAP signature verification is an extension of their existing gateway integration, not a greenfield implementation. The weakness is that it’s Visa-specific. A merchant accepting agent-initiated payments via Mastercard, PayPal, or newer payment rails needs to implement separate verification for each network.

Google AP2: Verifiable Credentials and Spending Mandates

Google’s Agent Pay Protocol takes a different architectural approach. Where TAP anchors agent identity to a payment network’s directory, AP2 is based on W3C Verifiable Credentials — a decentralized identity standard that allows an agent to present cryptographically signed claims about itself without requiring the verifying party to query a centralized registry.

The AP2 model introduces the concept of a spending mandate: a signed document that specifies what the agent is authorized to purchase, up to what amount, from which categories or merchants, and within what time window. When the agent presents an AP2 credential to a merchant, it includes the mandate, allowing the merchant to verify not just “this is a known agent” but “this agent is authorized to spend $X on Y today.”

PayPal announced support for A2A (Google’s Agent2Agent protocol, which AP2 integrates with) to enable next-generation commerce experiences. The A2A protocol itself — released in April 2025 under Apache-2.0 licensing, now governed by the Linux Foundation — provides the communication layer that AP2 rides on for agent-to-merchant interactions.

AP2’s advantage is network neutrality. A spending mandate doesn’t require Visa or Mastercard to be in the loop — any merchant that can verify a W3C Verifiable Credential can accept AP2-authenticated purchases. The disadvantage is implementation complexity: Verifiable Credentials infrastructure is newer, tooling is less mature, and smaller merchants are unlikely to build this without vendor support making it invisible at the gateway layer.

FIDO Alliance: The Interoperability Effort

Why fragmentation is the actual threat

In April 2026, the FIDO Alliance announced its Agentic Authentication Technical Working Group, with the explicit goal of developing interoperable specifications across the Visa TAP, Google AP2, and Mastercard Agent Pay approaches. This matters because without a bridge standard, the commerce layer of the agentic web risks becoming a fragmented authentication landscape where merchants must implement three different verification schemes to cover the agent population their customers actually use.

Mastercard’s Agent Pay uses a tokenized model — similar to how device-based payments work with network tokens — but specific to agent contexts. An agent is provisioned with a token that represents the user’s payment credential plus their authorization scope. The token is useless outside that scope, which limits fraud exposure but requires Mastercard’s tokenization infrastructure.

FIDO’s working group is targeting a common assertion format that all three networks can sign and any merchant can verify. Whether that goal is achievable before the market fragments enough to create lasting incompatibilities is the open question.

For context on why this matters operationally: the equivalent situation in human authentication was the fragmentation between proprietary SSO systems before SAML and then OAuth 2.0 standardized the space. The standardization took years and left substantial technical debt in its wake. Agent authentication is moving faster, with more commercial pressure, which could accelerate consensus — or entrench incompatible implementations before consensus is reached.

What This Means for Your Site Right Now

If you operate an e-commerce site or a platform that accepts orders, the honest answer is that full implementation of any of these standards requires your payment gateway to support them — and most gateways are currently in the early stages of adding that support. What you can do now is make sure you’re not starting from zero when your gateway rolls out agent authentication support.

Audit your agent traffic baseline

Before you can authenticate agents at the transaction layer, you need to understand what agents are already visiting your site and what they’re doing. As part of the Know Your Agent framework, this means logging agent-sourced requests separately from human sessions, identifying which agents are sending purchase-intent signals (product page dwell time, cart actions, checkout initiations), and establishing a baseline of expected agent behavior. Anomalies from that baseline are your fraud signal when authentication isn’t yet available.

Structure your checkout for agent parsing

TAP and AP2 both assume the agent can parse your checkout flow programmatically. If your checkout is a multi-step JavaScript-rendered flow that requires clicks to proceed, agents will struggle or fail. The technical requirement for accepting agent-initiated orders is the same as the requirement for being agent-readable in the first place: your purchase flow needs to be accessible via structured, predictable API calls or at minimum render meaningful structured data at each step. The MCP endpoints guide covers this in detail for commerce contexts.

Prepare your fraud rules for agent signatures

Current fraud detection models are trained on human behavioral signals — typing speed, mouse movement, session navigation patterns. Agent-initiated transactions will fail these checks even when they’re entirely legitimate. Before agent authentication standards land, work with your fraud team to establish agent-specific transaction scoring: a TAP-authenticated agent should carry a different risk score than an unauthenticated programmatic request, not be run through the same rules as a bot trying to card-test stolen credentials.

Identify which standard your key payment partners are betting on

If your primary payment volume runs through Visa, TAP is the path of least resistance — your gateway will surface it, and you’ll implement it as a configuration change rather than a build. If you’re working in markets or verticals where Google Pay or PayPal handles a larger share of agent-initiated volume, AP2 is the direction to watch. Most merchants should be planning for both, because the agents your customers use will reflect their own platform preferences, not yours.

The Verification Gap That Standards Don’t Close

TAP, AP2, and FIDO all solve the cryptographic identity question: can you prove this agent is who it claims to be? What they don’t solve — by design — is the behavioral verification question: is this agent acting in ways consistent with legitimate commerce, or has it been compromised, manipulated, or misconfigured in ways that make it a risk vector even with valid credentials?

A TAP-authenticated agent can still place orders at a rate that looks like inventory manipulation. An AP2-credentialed agent operating under a valid spending mandate can still hit your checkout endpoint with timing that resembles a coordinated campaign. Valid credentials don’t rule out misuse — they just shift liability and make attribution possible after the fact.

This is where agent readiness infrastructure and authentication infrastructure are complementary rather than substitutes. Authentication tells you who the agent is. Behavioral analysis tells you what it’s doing. You need both — particularly during the transition period when not all agents will present authentication credentials and you’ll still be receiving unauthenticated agent traffic that you need to handle with policy rather than cryptographic proof.

The sites that will come through this transition without avoidable fraud exposure are the ones treating agent verification as a layered problem: traffic policy at the edge (which agents can reach which endpoints), behavioral analysis in the application layer (what patterns trigger friction or blocking), and authentication at the transaction layer (which agents can complete purchases). The agentic web doesn’t arrive all at once, and the infrastructure for it doesn’t need to either — but each layer needs a plan before agent commerce volume in your category makes the absence of one expensive.

Where to Start

The standards are moving. Visa TAP is the most deployed path today, FIDO interoperability is the most important development to watch in the next 12 months, and AP2’s Verifiable Credential model is the likely long-term architecture for network-neutral agent commerce. None of them require you to build anything today that isn’t already a gateway or payment processor decision — but they do require you to understand your current agent readiness baseline, because that baseline is what you’ll be building on.

Run your free Agent Readiness Score to see where your site stands on agent accessibility, structured data, and verification infrastructure — before your competitors use the coming authentication wave to pull ahead on agentic distribution.