Checkout.com API logo

Agentic Commerce Protocol

Beta

Enable AI platforms to create scoped, single-use payment tokens to securely process agentic commerce transactions. This implementation follows the Agentic Commerce Protocol (ACP) delegated payment specification.

To onboard your AI platform, contact us.

Create a delegated payment token

Creates a delegated payment token to securely enable Checkout.com merchants to process agentic payments.

The token secures cardholder credentials for use in agentic commerce transactions. You must provide:

  • The card details
  • The spending constraints (allowance)
  • The Billing address
  • The risk signals

The request must include a valid HMAC-SHA256 signature in the Signature header and a timestamp in the Timestamp header to verify the request integrity.

SecurityAPI Key: ApiSecretKey
Request
header Parameters
Signature
required
string

A Base64-encoded HMAC-SHA256 signature used for request body integrity verification.

Compute the signature as follows:

  1. Concatenate the Timestamp header value (as a UTF-8 string) with the raw JSON request body (as a UTF-8 string).
  2. Compute the HMAC-SHA256 hash of the concatenated string using your shared HMAC signing key.
  3. Base64-encode the resulting hash.

Example: Base64(HMAC-SHA256(key, Timestamp + RequestBody))

Example: eyJtZX...
Timestamp
required
string <date-time>

The timestamp of the request, in RFC 3339 format (for example, 2026-03-11T10:30:00Z).

The timestamp must be within 5 minutes of the server time. Requests with a timestamp outside this window are rejected with a 401 response.

Example: 2025-09-25T10:30:00Z
Cko-Idempotency-Key
string

An optional idempotency key for safely retrying payment requests

API-Version
string

The API version to use for the request. If not specified, the default version (2026-01-30) is used.

Example: 2025-09-29
Request Body schema: application/json
required
object

The card payment method details.

required
object

The spending constraints for the delegated payment token.

required
Array of objects (DelegatedPaymentRiskSignal)

An array of risk assessment signals provided by the platform.

required
object

A set of key-value pairs to attach to the delegated payment request.

The metadata object only supports string values.

object

The customer billing address.

Responses
201

Delegated payment token created successfully

400

Malformed JSON or unreadable request body

401

Missing or invalid API key, or signature validation failure

403

Merchant not enabled for the authenticated platform

409

Idempotency key reused with a different request body

422

Unprocessable entity. One or more fields failed validation

500

An unexpected error occurred while processing the request

post/agentic_commerce/delegate_payment
Request samples
application/json
{
  • "payment_method": {
    },
  • "allowance": {
    },
  • "billing_address": {
    },
  • "risk_signals": [
    ],
  • "metadata": {
    }
}
Response samples
application/json
{
  • "id": "vt_abc123def456ghi789",
  • "created": "2026-03-11T10:30:00Z",
  • "metadata": {
    }
}