Agent Payments Protocol (AP2) Impacts to FAPI

未关闭
  • 哪里不对？
#742 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
冷清
领域
authentication, payments, security

调研方向

首先阅读链接的 AP2 Specification，尤其是说明性交易流程，并将其 OAuth2 安全配置与 FAPI scope 进行比较。审阅所引用的 AP2、A2A x402 和 Google 材料；当相关影响和由此产生的 FAPI 任务得到清晰记录时，工作即告完成。

由索引模型根据 Issue 内容生成。

描述

migrated-from-bitbucket priority: minor type: task

Originally submitted by Nat (Nat Sakimura) on 2025-09-17

In the Sept 17 call, in AOB, AP2 Imapcs to FAPI was talked about. We decided to track it as a task.

Following is the copy of my email to the list that kicked off this discussion.

I came across the news that Google announced "Powering AI commerce with the new Agent Payments Protocol (AP2)" my morning today (i.e. like 14 hours ago). 

I have not grasped the protocol yet, but it is based on the A2A protocol and uses OAuth. Specifically, the "Sample Credential Provider Agent Card" code snippet within the technical implementation section of AP2 Specification [3] shows OAuth2 as part of its security configuration. This seems to indicate that a Credential Provider (CP) uses an OAuth2  for skills such as get_payment_methods, which retrieves a user's payment methods.

The configuration includes details for the authorizationCode flow, specifying an authorizationUrl, scopes (particularly for get_payment_methods), and a tokenUrl. This seems to indicate that OAuth2 is used by Credential Providers within the AP2 ecosystem to secure access to users' payment credentials

Intuit, Mastercard, Okta and PingIdentity seem to be contributing to it. 

10 Key Points of Agent Payments Protocol (AP2)

  1. Launch and Purpose: AP2 is an open protocol launched by Google on September 16, 2025, developed with over 60 leading payments and technology companies. Its purpose is to securely initiate and transact agent-led payments across platforms.
  2. Extension of Existing Protocols: It functions as an extension of the Agent2Agent (A2A) protocol and Model Context Protocol (MCP).
  3. Payment-Agnostic Framework: AP2 establishes a payment-agnostic framework, enabling secure transactions across all payment methods, including credit/debit cards, stablecoins, and real-time bank transfers.
  4. Addressing AI Agent Payment Challenges: It addresses critical questions arising from AI agents transacting on behalf of users, such as authorization, authenticity, and accountability, which challenge traditional payment system assumptions.
  5. Trust through Mandates: AP2 builds trust using Mandates—tamper-proof, cryptographically-signed digital contracts that serve as verifiable proof of user instructions. These are signed by verifiable credentials (VCs).
  6. Two User Scenarios: Mandates support two primary user interaction scenarios:

◦ Real-time Purchases (human present): An "Intent Mandate" is captured, and user approval signs a "Cart Mandate" for specific items and prices.

◦ Delegated Tasks (human not present): A detailed "Intent Mandate" is signed upfront with rules, allowing the agent to automatically generate a "Cart Mandate" when conditions are met.

  1. Non-Repudiable Audit Trail: The complete sequence from intent to cart to payment creates a non-repudiable audit trail, providing a clear foundation for accountability by answering questions of authorization and authenticity.
  2. Enabling New Commerce Experiences: AP2's flexible design supports new commercial models like smarter shopping, personalized offers, coordinated tasks, and B2B applications for autonomous procurement.
  3. Support for Emerging Payment Systems: It is designed as a universal protocol for stablecoins and cryptocurrencies, with Google collaborating with Coinbase and others to launch the A2A x402 extension for agent-based crypto payments.

10. Open Collaboration and Evolution: Google is committed to evolving AP2 through an open, collaborative process, including engagement with standards bodies, and invites the entire payments and technology community to contribute via its public GitHub repository

References

  1. Google Blog: Powering AI commerce with the new Agent Payments Protocol (AP2) https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol?hl=en
  2. Agent Payments Protocol (AP2): https://github.com/google-agentic-commerce/AP2
  3. AP2 Specification: https://ap2-protocol.org/specification/#71-illustrative-transaction-flow
  4. A2A x402 Extension: https://github.com/google-agentic-commerce/a2a-x402

Best, 

‌

Nat Sakimura

‌

Bitbucket status: open

Bitbucket origin: issue 754

主要语言
HTML
星标
5
派生
3
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

openid/fapi 的其他 Issue

查看 openid/fapi 的全部 Issue

相似的 Issue

更多 Security Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。