Google AP2, UCP, and A2A: where AffixIO fits in Google's agent payment stack

Google is not a card network and not a merchant acquirer. Its agent payment work standardises how agents describe intent, discover merchants, and prove delegated spend. That positions Google as the schema and authorization spec owner while partners handle settlement.

In September 2025 Google announced AP2 with more than 60 partners including Mastercard, PayPal, and American Express. UCP followed with Shopify, Walmart, Target, Etsy, and Wayfair. A2A provides the agent communication layer with optional x402 settlement extensions co-developed with Coinbase.

AP2 answers whether an agent was permitted to spend. A user signs a mandate specifying amount caps, merchant categories, expiry, and allowed payment rails. The agent attaches that mandate when initiating checkout or API purchases.

AP2 does not replace issuer authorization systems. A valid mandate signed yesterday does not tell the issuer whether the account is frozen today, whether the merchant is on a block list, or whether fraud rules should decline. That live decision belongs in a verification layer.

The Universal Commerce Protocol gives agents structured product data: SKU, price, inventory signals, shipping constraints, and return policies. Shopping agents on Gemini or third-party orchestrators can build carts without brittle web scraping.

UCP reduces friction before payment. It does not verify that the paying agent is authorised. Merchants adopting UCP still need a gate at checkout that confirms agent identity and spend permission. AffixIO plugs into that gate.

Retailers on UCP typically run: agent reads UCP feed, agent builds cart, merchant checkout calls AffixIO, settlement via card or x402 proceeds on YES.

A2A lets agents publish Agent Cards: JSON documents describing name, capabilities, authentication, and endpoints. Agent A discovers Agent B, negotiates a paid task, and coordinates execution.

Agent Cards are claims. A malicious agent can publish a convincing card. Before money moves, the receiving side needs a registry check: is this agent instance allowed to act and pay? AffixIO returns YES or NO against your authorised agent registry in sub-second time. See A2A protocol and Agent Cards.

Google's A2A x402 extension lets agents settle micropayments over HTTP 402 after A2A coordination. AP2 can authorize; x402 settles; AffixIO verifies between those steps when policy requires it.

Google defines standards. Issuers, merchants, and PSPs implement them. Three gaps appear in every production rollout:

1. Live eligibility: Mandates are static snapshots; accounts and fraud state change continuously.
2. Cross-network policy: AP2 partners interpret mandates differently; a binary verification API normalises outcomes.
3. PII minimisation: Audit teams want proof a check ran without copying customer records into another vault.

AffixIO is complementary infrastructure. POST /v1/verify with an agent identifier, mandate reference, and circuit ID. Response: eligible true or false and data_retained: null.

For issuers in the AP2 consortium

Map mandate fields to AffixIO circuits. Return authorization advice enriched with verification metadata. No duplicate storage of mandate payloads inside AffixIO.

For UCP merchants

Call verification before creating payment intents. Reject agent checkout early on NO to reduce chargebacks. See merchant AI agent verification.

1. Parse AP2 mandate claims at your gateway
2. Map merchant and agent context to an AffixIO circuit
3. Call POST /v1/verify before capture or x402 settlement
4. Log audit hash; retain mandates in your controller systems only
5. Wire YES/NO into UCP checkout webhooks and A2A paid-task handlers

API docs: openapi.json, technical architecture, full agent payment stack.

Explore AffixIO

What is AffixIO · Agentic payments · AI hub · Merchant verification · Contact