Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Shopify Opens WebMCP Checkout to AI Agents
September 29, 2026 | NCFA Market Activity | Artificial Intelligence And Data, Payments Infrastructure And Money Movement, Venture Funding And Building
Buyer controlled checkout access for browser AI agents
On September 28, 2026, Shopify expanded WebMCP checkout support, allowing compatible AI browser agents to read and update eligible checkouts and submit orders after buyer approval. The Ottawa based commerce company now lets software agents move beyond product discovery and cart management into checkout itself, while keeping purchase approval and payment authority under separate controls.
Shopify already exposes product search, store browsing and cart functions to agents. Checkout is an important addition because the software can now move from helping someone shop to executing a real transaction. Can the agent spend on its own? No. Shopify still separates what the agent can do inside checkout from what the customer can authorize and what the payment provider will accept.
Shopify says millions of businesses in more than 175 countries use its commerce infrastructure, which processed US$378 billion in gross merchandise volume in 2025. A Canadian company operating at that scale is now helping define how software agents enter commerce without turning access to checkout into open authority over a customer's money.
Shopify Opens Checkout Functions To AI Agents
WebMCP lets a website expose specific functions directly to a compatible browser agent. Instead of inspecting a page and trying to work out which field or button to use, the agent can see the actions Shopify makes available and the information each action requires. It improves transaction reliability because checkout needs predictable actions and an accurate view of the order, while product discovery can tolerate more browser trial and error.
Shopify first exposed WebMCP tools for storefronts on August 5, 2026, letting agents search products, browse stores, manage carts and take shoppers to checkout. The September release extends that access so the agent can read the current checkout, update supported information and submit the order after the customer approves it. Contact details, fulfillment choices, discounts and some payment information can be changed, while the agent and customer continue working from the same checkout state.
Access isn't universal though. Shopify excludes several flows, including B2B checkout, embedded checkout, draft orders, order edits and payment collection. Standard three page checkout is also excluded unless the customer uses Shop Pay. Merchants do not need to install a separate WebMCP app for eligible sessions, giving Shopify a way to expose agent access through infrastructure merchants already use rather than requiring a new integration for every AI shopping service.
Browser WebMCP also differs from Shopify's server based commerce tools. WebMCP operates inside the shopper's open browser tab, while Checkout MCP lets an agent service interact with checkout from its own server. Both use Shopify's Universal Commerce Protocol checkout model. Shopify is turning parts of checkout into functions software can call directly while retaining control over which functions it exposes.
Buyer Approval And Payment Authority Remain Separate
If an agent can operate checkout, who controls the purchase? Shopify requires the customer to review the current order and total before the agent can submit it. If the amount changes, the agent has to ask again. Permission therefore applies to the transaction the customer sees, not to an open instruction that allows the agent to keep spending.
Shopify also keeps agent identity separate from purchase authority. Web Bot Auth can identify a registered agent, but recognition doesn't provide the software permission to place an order. Payment access is even more narrow. Checkout WebMCP doesn't accept new card details. An eligible saved Shop Pay card can be selected, while other payment methods or authentication steps may return control directly to the customer. Shop Pay login and 3D Secure are examples.
The transaction is controlled by several parties. Shopify decides what the agent can do inside checkout, the customer decides whether the current purchase should proceed, and the payment provider decides whether the credential can be used and whether more authentication is required. That separation between agent identity and financial authorization becomes more important as AI agents evolve from recommending products to initiating real transactions.
In September, Mastercard, Flybits and Rogers Bank demonstrated an AI shopping assistant completing a card purchase after the customer supplied buying instructions and a spending limit. Mastercard Agent Pay operates around the credential, agent identity and instructions attached to the payment. Shopify controls what the agent can do inside merchant checkout.
Are Shopify and Mastercard trying to own the same part of agent commerce? Not really. One controls access to the merchant transaction. The other operates where payment credentials and authorization take over. As AI performs more of the purchase, those separate control points become easier to see.
Shopify Can Lose Discovery Without Losing The Transaction
If shopping assistants become easy to reproduce, more valuable infrastructure may develop around checkout access, agent identity, payment credentials, spending limits, merchant restrictions, fraud controls and records showing who approved what. A founder doesn't need to build another shopping assistant to participate in agent commerce. There are products to build between the assistant and the transaction.
See: Circle Builds USDC Payment Infrastructure for AI Agents
Discovery, checkout, credential use and authentication don't have to belong to one company. Different providers can control each function, which makes the handoffs commercially important. Companies that become difficult to remove from those handoffs may capture value even if consumers rarely recognize their names.
Product discovery may happen inside ChatGPT, Gemini, Copilot or another agent rather than on a merchant storefront. Does that weaken Shopify's position? It can reduce Shopify's control over the first interaction, but the transaction can still reach Shopify checkout, merchant systems and payment infrastructure. Shopify can remain part of the economic relationship even when another platform owns the conversation that starts the purchase.
Talking Point
Structured agent access also creates another route into checkout without requiring every AI system to interpret the storefront visually. The commercial evidence is still early, but the technical capability now exists. The market still has to prove whether consumers want agents doing enough purchasing to create a significantly different commerce channel and whether merchants see enough value to change how they manage sales, fraud and customer relationships.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply