Agent Credential
An agent credential is verifiable information that an AI agent presents to a merchant, bank or platform to prove what it is, which person or business it acts for and what it has been authorised to do. The recipient checks it, usually by verifying a cryptographic signature, before letting the agent browse, check out or pay.
- Also known as
- AI agent credential, Agent identity credential
- Used at
- agent-led shopping and checkout, payments an agent makes on a user's behalf, and any website that must tell an approved agent from a malicious bot
- Contents
- an identity for the agent and its developer, a link to the user it represents, the scope of its authority (spending limits, merchants, expiry) and often a payment credential restricted to that agent
- Standards underneath
- HTTP Message Signatures (IETF RFC 9421, February 2024) for signing requests, and W3C Verifiable Credentials (version 2.0 a W3C Recommendation since May 2025) for claims signed by an issuer
- Industry frameworks
- Google's Agent Payments Protocol (AP2, September 2025) records the user's instructions as signed "mandates"; Visa's Trusted Agent Protocol (October 2025, developed with Cloudflare) has approved agents sign their requests so merchants can recognise them
- Parties
- the user who delegates, the agent developer, the network or identity provider that vouches for the agent, and the merchant or bank that verifies it
How an agent credential works in practice
Checkout systems were built for two kinds of visitor: people, who get a checkout page, and bots, which get blocked. An AI agent buying on someone's behalf is neither, and without a credential a merchant's bot defences treat it as the second. The credential closes that gap. The agent's developer registers with a network or identity provider and receives signing keys; each request the agent sends carries a signature the merchant can check against a published key, showing that this is a known agent and not a scraper borrowing its name.
Identity alone is not authority. A second layer records what the user actually allowed: buy these running shoes for up to €120, or book the cheapest refundable flight before Friday. In AP2 this takes the form of an intent mandate and a cart mandate that fixes the items and price; a card network may add a payment token that works only for that agent and within those limits. When something goes wrong — the agent bought the wrong item, or a fraudster used a compromised agent — the signed record is what the issuer, the merchant and the user argue from.
For a payments company or merchant platform, accepting agent credentials is becoming part of fraud and checkout strategy. For an investor, the questions are which credential schemes a product depends on, whether it can verify several of them, and how its contracts allocate liability for purchases an agent makes.
Example
A European fashion marketplace finds that 9% of its checkout sessions come from AI agents, and its bot filter blocks 70% of them. It adopts signed agent verification: requests carrying a valid signature from a registered agent skip the bot challenge, while unsigned automated traffic is still blocked. It also accepts agent-bound payment tokens that carry a €300 per-transaction limit set by the user. Within a quarter, completed agent checkouts rise from 2,100 to 7,400 a month at an average basket of €85. Fraud on signed-agent orders runs at 0.04% of value against 0.09% for the site as a whole, and the 31 disputes on agent orders are resolved from the signed mandates in the order records rather than on the customer's word alone.
Common mistakes
- Treating the agent's identity as proof of the user's consent; one says who is calling, the other what was authorised. - Waving through all automated traffic once some agents are welcome, instead of verifying signatures. - Keeping no copy of the signed instructions, leaving nothing to settle a dispute with. - Building on one network's scheme without planning for the others agents will use. - Issuing credentials with no expiry or spending scope, so a stolen key can buy anything. - Assuming existing dispute rules already cover every agent purchase without reading the contracts.