Cloudflare, Visa, Mastercard, AmEx wire rails for AI agents
Visa unveils the Trusted Agent Protocol; Cloudflare ties it into Web Bot Auth with Visa, Mastercard and AmEx.
Agentic commerce uses AI bots that shop and pay on behalf once you set the rules. The goal is simple: let merchants trust AI agents at checkout amid a 4,700% surge in AI retail traffic, then route payments safely.
Visa’s new protocol defines how an approved agent identifies itself, proves intent to buy and passes limited customer context. It builds on HTTP Message Signatures. It’s aligned with work under way in IETF, the OpenID Foundation and EMVCo. Visa ships TAP in the Developer Center and on GitHub.
Cloudflare extends this model to payment networks. With Web Bot Auth, merchants can tell a “verified agent” from a rogue bot without ripping out existing checkout flows. Visa is incorporating the protocol into its Intelligent Commerce stack; Mastercard folds it into Agent Pay; American Express will also leverage Web Bot Auth in its agentic commerce program. Early ecosystem collaborators include Adyen, Checkout.com, Circle, Fiserv, Microsoft, Nuvei, Shopify, Webflow and Worldpay.
For the merchant, what actually shows up is simple: agent intent, whether the shopper has an account, and optional payment details so the agent can use the merchant’s preferred method – card, debit, crypto. The point is fewer false blocks, more verified agent sessions, and clearer attribution to the human behind the agent.
This move sits on a broader Cloudflare arc. The company has outlined a NET Dollar stablecoin for machine‑to‑machine settlement and, with Coinbase, is forming the x402 Foundation to standardize agent payment messages. Combined with TAP/Web Bot Auth, the stack follows three steps: authentication → messaging → settlement.
The future of commerce is agentic, and Cloudflare is building the trusted foundation for it,notes Stephanie Cohen, Chief Strategy Officer at Cloudflare.
Visa’s Jack Forestell, Chief Product & Strategy Officer, emphasized that agent‑initiated transactions should be as seamless and secure as today’s payments.
For crypto readers, this bridges AI agents with on-chain payments. If agents can authenticate at scale and merchants can accept their sessions, stablecoins and programmable payouts become natural rails for subscriptions, top‑ups and micro‑purchases. This also aligns with Galaxy Digital CEO Michael Novogratz’s view that AI systems will become the largest users of stablecoins as agents transact on users’ instructions.
In the near term, the focus is on execution. Networks and PSPs will pilot TAP/Web Bot Auth, while standards groups test interoperability with other agent protocols. Success depends on fraud controls, wallet UX and data‑sharing guardrails; if those stumble, merchants will block more agent traffic by default.
