---
title: "Agent Credential"
url: "https://mahouse.world/glossary/agent-credential"
type: "glossary term"
author: "Ihor Vlasov"
reviewed: "2026-09-30"
published: "2026-09-22"
---

# Agent Credential

An agent credential is verifiable information that an AI agent presents to a merchant, bank or platform to prove what it is, which person or business it acts for and what it has been authorised to do. The recipient checks it, usually by verifying a cryptographic signature, before letting the agent browse, check out or pay.

**Also known as:** AI agent credential, Agent identity credential

## Key facts

- **Used at:** agent-led shopping and checkout, payments an agent makes on a user's behalf, and any website that must tell an approved agent from a malicious bot
- **Contents:** an identity for the agent and its developer, a link to the user it represents, the scope of its authority (spending limits, merchants, expiry) and often a payment credential restricted to that agent
- **Standards underneath:** HTTP Message Signatures (IETF RFC 9421, February 2024) for signing requests, and W3C Verifiable Credentials (version 2.0 a W3C Recommendation since May 2025) for claims signed by an issuer
- **Industry frameworks:** Google's Agent Payments Protocol (AP2, September 2025) records the user's instructions as signed "mandates"; Visa's Trusted Agent Protocol (October 2025, developed with Cloudflare) has approved agents sign their requests so merchants can recognise them
- **Parties:** the user who delegates, the agent developer, the network or identity provider that vouches for the agent, and the merchant or bank that verifies it

## How an agent credential works in practice

Checkout systems were built for two kinds of visitor: people, who get a checkout page, and bots, which get blocked. An AI agent buying on someone's behalf is neither, and without a credential a merchant's bot defences treat it as the second. The credential closes that gap. The agent's developer registers with a network or identity provider and receives signing keys; each request the agent sends carries a signature the merchant can check against a published key, showing that this is a known agent and not a scraper borrowing its name.

Identity alone is not authority. A second layer records what the user actually allowed: buy these running shoes for up to €120, or book the cheapest refundable flight before Friday. In AP2 this takes the form of an intent mandate and a cart mandate that fixes the items and price; a card network may add a payment token that works only for that agent and within those limits. When something goes wrong — the agent bought the wrong item, or a fraudster used a compromised agent — the signed record is what the issuer, the merchant and the user argue from.

For a payments company or merchant platform, accepting agent credentials is becoming part of fraud and checkout strategy. For an investor, the questions are which credential schemes a product depends on, whether it can verify several of them, and how its contracts allocate liability for purchases an agent makes.

## Example

A European fashion marketplace finds that 9% of its checkout sessions come from AI agents, and its bot filter blocks 70% of them. It adopts signed agent verification: requests carrying a valid signature from a registered agent skip the bot challenge, while unsigned automated traffic is still blocked. It also accepts agent-bound payment tokens that carry a €300 per-transaction limit set by the user. Within a quarter, completed agent checkouts rise from 2,100 to 7,400 a month at an average basket of €85. Fraud on signed-agent orders runs at 0.04% of value against 0.09% for the site as a whole, and the 31 disputes on agent orders are resolved from the signed mandates in the order records rather than on the customer's word alone.

## Common mistakes

- Treating the agent's identity as proof of the user's consent; one says who is calling, the other what was authorised.
- Waving through all automated traffic once some agents are welcome, instead of verifying signatures.
- Keeping no copy of the signed instructions, leaving nothing to settle a dispute with.
- Building on one network's scheme without planning for the others agents will use.
- Issuing credentials with no expiry or spending scope, so a stolen key can buy anything.
- Assuming existing dispute rules already cover every agent purchase without reading the contracts.

## Related terms

- [AI Agent](https://mahouse.world/glossary/ai-agent.md)
- [Network Token](https://mahouse.world/glossary/network-token.md)
- [Tokenization](https://mahouse.world/glossary/tokenization.md)
- [Strong Customer Authentication](https://mahouse.world/glossary/strong-customer-authentication.md)
- [Identity Verification](https://mahouse.world/glossary/identity-verification.md)
- [Know Your Business](https://mahouse.world/glossary/know-your-business.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-30. https://mahouse.world/authors/ihor-vlasov