What are agentic tokens?
They are the credential the agent actually carries. Mastercard says an agent has to be registered and verified before it can transact on the network, after which it is uniquely identified and pays using agentic tokens, which Mastercard describes as dynamic, cryptographically secure credentials that make every transaction traceable and authenticated (Mastercard).
The tokens are an extension of the tokenisation Mastercard already runs rather than a new rail. Both trade reports of the launch describe them as building on the capabilities behind mobile contactless payments, and on programmable payments such as recurring expenses and subscriptions (PYMNTS, The Paypers). The Paypers also lists secure card-on-file and Mastercard Payment Passkeys.
The card number never reaches the agent. The token is what says which agent is spending and under whose authority, which is the part a merchant can check. The spending-limits page sets out where that authority is actually enforced.
Who were the launch partners?
Mastercard named four, in two groups. It said it would work with Microsoft on new use cases and with IBM, through its watsonx Orchestrate product, on business-to-business ones; and with acquirers and checkout providers, Braintree and Checkout.com among them, to extend the tokenisation those firms already run for merchants (PYMNTS, The Paypers). The Paypers reports the Microsoft work as integrating Azure OpenAI Service and Copilot Studio with Mastercard's payment products.
Salesforce is sometimes listed as a fifth launch partner. Neither of those two reports names it, so it is left out here.
How does a merchant accept an agent payment?
Without writing code, if Mastercard's preferred route is taken. The Agent Pay Acceptance Framework, published on 14 October 2025, asks merchants to implement the Web Bot Auth standard at the content delivery network layer, which lets them verify an agent is genuine and block untrusted traffic without deploying anything new. A verified agent then submits a Dynamic Token Verification Code, an agentic token formatted to fit the ordinary card fields on a checkout form (Mastercard).
An existing checkout page can therefore take an agent payment without being rebuilt, because the agent is filling in a field the form already has. Mastercard also says the framework passes purchase intent data, including cart contents, transaction limits and validity windows, and that the merchant can use it as an audit trail in a dispute.
Web Bot Auth itself belongs to neither network. Both Mastercard and Visa build on it, which is why the agent-detection page covers it alongside Visa's Trusted Agent Protocol.
What are Agent Suite for Merchants and Agent Connect?
These are the merchant-facing half of the stack. Agent Suite for Merchants lets a business bring agent-powered shopping, including product discovery, research and consumer-authorised purchases, into the e-commerce environment it already runs, and it is sold through Mastercard Merchant Cloud alongside fraud protection, authentication, tokenisation, data and partner services (TradeArabia, TechAfrica News).
On 9 September 2026 Mastercard added Agent Connect to it, a single integration through which merchants, AI agents, platforms and payment providers connect and transact (PYMNTS, Digital Transactions). PYMNTS dates the original Agent Suite to January.
The same announcement put Anthropic's commerce agent blueprint into the suite, so a merchant can build a shopping agent on Claude models wired to Mastercard's payment and personalisation services (Digital Transactions, crypto.news). Samsung and Trip.com were named as adopters.
What is Agent Pay for Machines?
It is a separate network, built for software paying software. Mastercard launched it on 10 June 2026, and it settles across cards, bank accounts and stablecoins while authenticating the agent, enforcing spending rules and guaranteeing settlement (CoinDesk). Fortune, which ran it as an exclusive that morning, describes it as meant to make smaller transfers easier, its example being an agent paying to pull a website's data piecemeal (Fortune).
The permissions do not sit in Mastercard's own database. Both reports say the authority a person grants an agent is recorded on a blockchain, initially Polygon, Solana and Base, so that any party to a transaction can check for itself whether the agent is acting within instructions (CoinDesk, Fortune). CoinDesk counts more than 30 participating firms, including Coinbase, Stripe, Adyen, Checkout.com, Cloudflare, Polygon Labs, the Solana Foundation and OKX.
Does it compete with AP2, ACP and UCP?
No, and Mastercard has said so directly. Writing on 20 January 2026, its chief digital officer and its global head of digital commercialization said Mastercard had joined Google's Universal Commerce Protocol the week before, and that it continues to collaborate across Google's Agent Payments Protocol and Agent2Agent Protocol and OpenAI's Agentic Commerce Protocol, so that all of them meet the same standards for clear user intent, secure credentials and verifiable agent identity (Mastercard). Mastercard is named among the sixty-odd organisations in Google's AP2 launch post (Google Cloud).
A protocol describes how an agent and a merchant talk. Agent Pay is the credential and the network underneath, and Mastercard says its acceptance framework was built to be compatible with those protocols rather than to replace them. The ACP and AP2 page and the UCP page cover that layer.
Where can you actually use it?
Less widely than the announcement count suggests. Mastercard said in January 2026 that it was working with Microsoft to bring Agent Pay to Copilot Checkout (Mastercard), and that is the company's own account of work in progress rather than a shipped product.
The clearest dated deployment is travel. Trip.com's TripGenie agent, running on Agent Suite for Merchants with Network International as acquirer, was shown at Arabian Travel Market as a global first, and the partners expect a phased rollout and commercial launch in early 2027 (TradeArabia, TechAfrica News). A showcase carrying a 2027 date is roughly where the whole field currently sits.
For anyone selling today, two questions to put to a processor are worth more than the launch dates: which integration route it expects you to take, the no-code Web Bot Auth one or Agent Connect, and what its contract says when an agent buys the wrong thing. The liability page is where the second answer usually runs out.