AP2 under FIDO governance: what it means for merchants
Last updated: · Leutrim Miftaraj
The Agent Payments Protocol was handed over to the FIDO Alliance in April 2026; version 0.2 allows autonomous transactions based on pre-authorised instructions for the first time, through human-not-present payments. For merchants this means: payment authorisation becomes standard — authorisation of the action remains their job.
Three mandates, one chain
AP2 chains intent, cart and payment mandates as signed W3C Verifiable Credentials — cryptographically clean for checkout. Since April 2026 Mastercard accepts AP2 mandates issued by PSPs as Verifiable Intent; Visa and Stripe have signed up.
The open flank
AP2 answers «may this payment be executed?» — not «was the agent allowed to make this purchase for this person at all, and what does the contract say in a dispute?» That is exactly where the agent mandate comes in: payment.* encapsulates AP2 as a subtype, one check covers both levels.
Practical recommendation
Mandate verify as pre-authorisation before the AP2/SPT step — the 150 ms budget fits existing auth flows, and the signed receipt adds the authority layer to the payment chain.
Key takeaway
AP2 is the payment freight. The mandate is the bill of lading.
Try it yourself
Issue your first agent mandate and check your first decision with its receipt — free, in a few minutes.