OpenAI Checkout Protocol

Agentic Commerce Protocol

Enable ChatGPT to manage complete checkout flows while you maintain control over payments, customer data, and compliance. Built with Rust for maximum performance.

Protocol Documentation Get Started

11.5K

Lines of Rust

REST Endpoints

<50ms

Response Time

Language Bindings

What is the Agentic Commerce Protocol?

The Agentic Commerce Protocol (ACP) is OpenAI's specification for enabling AI agents to manage end-to-end checkout flows directly within chat conversations. It separates checkout orchestration from payment processing, giving merchants full control.

Complete purchases without leaving ChatGPT

Use your existing Payment Service Provider (PSP)

Maintain merchant control over customer data

Full compliance with payment regulations

Protocol Architecture

ChatGPT

AI Agent Interface

ACP Handler

Checkout Orchestration

Merchant Backend

Orders & Inventory

Payment PSP

Stripe / Shopify

Checkout Flow

A complete checkout journey from session creation to order completion

not ready for payment

ready for payment

completed

canceled

ChatGPT                    ACP Server                  Merchant Systems
   │                            │                             │
   │─ POST /checkout_sessions ──│                             │
   │  (items, buyer, address)   │                             │
   │                            ├─ Get product info ─────────>│
   │                            │<─ price, inventory ─────────│
   │                            ├─ Calculate tax ────────────>│
   │                            │<─ tax amount ───────────────│
   │<─ 201 Created ─────────────│                             │
   │  (session_id, totals)      │                             │
   │                            │                             │
   │─ POST /delegate_payment ───│                             │
   │  (card details)            ├─ Create vault token ───────>│
   │<─ 201 Created ─────────────│<─ vt_xxx ───────────────────│
   │  (vault_token)             │                             │
   │                            │                             │
   │─ POST /complete ───────────│                             │
   │  (vault_token)             ├─ Process payment ──────────>│
   │                            │<─ success ──────────────────│
   │                            ├─ Create order ─────────────>│
   │<─ 200 OK ──────────────────│<─ order_id ─────────────────│
   │  (order)                   │                             │
   │                            ├─ Webhook: order_created ───>│ OpenAI
   │                            │                             │

API Endpoints

Six REST endpoints for complete checkout lifecycle management

POST/checkout_sessions

Create Checkout Session

Initialize a new checkout session with items, buyer info, and shipping address

Request

{
  "items": [
    { "id": "item_123", "quantity": 2 }
  ],
  "buyer": {
    "first_name": "John",
    "email": "john@example.com",
    "phone_number": "+14155551234"
  },
  "fulfillment_address": {
    "name": "John Doe",
    "line_one": "123 Main St",
    "city": "San Francisco",
    "state": "CA",
    "country": "US",
    "postal_code": "94105"
  }
}

Response

{
  "id": "session_abc123",
  "status": "ready_for_payment",
  "currency": "usd",
  "items": [...],
  "totals": {
    "subtotal": { "amount": 10000, "currency": "usd" },
    "tax": { "amount": 875, "currency": "usd" },
    "shipping": { "amount": 1000, "currency": "usd" },
    "grand_total": { "amount": 11875, "currency": "usd" }
  },
  "fulfillment_options": [
    { "id": "standard", "label": "Standard Shipping", "price": { "amount": 1000 } },
    { "id": "express", "label": "Express Shipping", "price": { "amount": 2500 } }
  ],
  "messages": [
    { "type": "info", "content": "Express shipping available" }
  ]
}

Delegated Payments

Single-Use Vault Tokens

Secure payment delegation with amount constraints, expiry, and session binding

Single-Use Enforcement

Tokens are consumed after first use. Any reuse attempt is blocked and logged for fraud detection.

Allowance Constraints

Maximum amount limits per token. Checkout cannot exceed the allowance, preventing overcharges.

Time-Limited Expiry

Tokens expire after 15-30 minutes. Expired tokens are rejected, ensuring timely completion.

Token Lifecycle

Card Details

Vault Token

Checkout Complete

Token Invalidated

Platform Integrations

Connect with your existing commerce and payment infrastructure

OpenAI ChatGPT

Native integration with ChatGPT for conversational commerce checkout flows

Chat-initiated checkout sessions

Rich message formatting for AI display

Webhook notifications for order events

HMAC-SHA256 signature verification

Configuration

// Webhook payload sent to OpenAI
{
  "type": "order_created",
  "data": {
    "type": "order",
    "checkout_session_id": "session_abc123",
    "status": "created",
    "permalink_url": "https://merchant.com/orders/xyz789",
    "refunds": []
  }
}

// Signature header for verification
X-Signature: HMAC-SHA256(payload, webhook_secret)

Enterprise Security

Built with security-first principles for production commerce workloads

Single-Use Vault Tokens

Payment tokens are consumed after first use, preventing replay attacks and fraud

Allowance Constraints

Max amount limits, expiry times, and session binding on all vault tokens

HMAC Signatures

Webhook payloads signed with HMAC-SHA256 for authenticity verification

Bearer Token Auth

API key authentication with per-key rate limits and expiry support

Idempotency Keys

Safe retries with idempotency keys cached for 24 hours

Rate Limiting

Per-API-key rate limiting with Governor for low-latency enforcement

Rust Architecture

High-performance async implementation with Axum and Tokio

Core Modules

service.rs

Core checkout business logic1,052

grpc.rs

gRPC API implementation796

main.rs

HTTP handlers and routing765

shopify_integration.rs

Shopify backend723

spec.rs

API spec transformation672

stripe_integration.rs

Stripe payments510

delegated_payment.rs

Vault token lifecycle393

webhook_service.rs

Event delivery230

Technology Stack

Runtime

Tokio 1.0

HTTP Framework

Axum 0.7

gRPC

Tonic 0.12

Serialization

Serde

Metrics

Prometheus

Rate Limiting

Governor

Performance Characteristics

Session Creation<50ms

Token Delegation<50ms

Checkout Complete<100ms

Concurrent Sessions1000s

LLM-Aware Responses

Rich message formatting designed for ChatGPT display and understanding

Info Messages

Helpful guidance for the user

"Express shipping available for faster delivery"

Warning Messages

Important notices about the order

"Item low in stock - only 2 remaining"

Error Messages

Validation failures with codes

"Invalid postal code for selected country"

10 Language Bindings

Native bindings for every major programming language and platform

🟢

Node.js

N-API

🐍

Python

PyO3

🔵

CGO

☕

Java

JNI

🟣

Kotlin

JNI + Coroutines

💎

Ruby

rb-sys

🐘

PHP

FFI

🍎

Swift

SPM

🔷

.NET

P/Invoke

🌐

WebAssembly

Browser

Enable ChatGPT Checkout

Let AI agents complete purchases on behalf of your customers while you maintain full control

Read the Docs Talk to Sales