A2A (Agent2Agent)
An open protocol for agents to talk to each other. Its specification calls it "an open standard designed to facilitate communication and interoperability between independent, potentially opaque AI agent systems", and labels 1.0.0 its "Latest Released Version". See MCP, A2A and WebMCP for stores.
ACP (Agentic Commerce Protocol)
A checkout protocol whose README describes it as "an interaction model and open standard for connecting buyers, their AI agents, and businesses to complete purchases seamlessly". Its maintainers file lists OpenAI, Stripe and Meta, and the README says it "is currently in beta". See ACP explained.
Agent card
A2A's description of an agent, which the specification calls "A self-describing manifest for an agent". It can be published at /.well-known/agent-card.json. See MCP, A2A and WebMCP for stores and our A2A agent card check.
Agent Pay (Mastercard)
Mastercard's programme for agent payments. Its April 2025 announcement calls it "its Agentic Payments Program, Mastercard Agent Pay", and says it "introduces Mastercard Agentic Tokens". See how an agent pays without seeing your card.
Agent readiness
How well an AI agent can use a site for a person; that wording is ours, because the term has no standard meaning. Cloudflare says its score shows "how well their websites support AI agents", and specification.website calls it "the set of choices that make a site legible to AI agents and LLMs". See what is agent readiness, and how is it measured?, or run our agent readiness scanner on your own store.
Agentic checkout
A name two companies use for different things. In OpenAI's docs, the Agentic Checkout Spec "enables ChatGPT to act as the customer's AI agent and renders a checkout experience embedded in ChatGPT's UI"; Google uses "agentic checkout" for a price-tracked item, where it offers "the option to have Google buy it for you on the merchant's site using Google Pay". See why agents stall at checkout.
Agentic commerce
Shopping done by an AI agent on a person's behalf (our wording). Google describes it as "where AI completes tasks on people's behalf"; Stripe, Shopify, Visa and Forrester each word it differently, and none of them says who coined it. See what is agentic commerce?
AIPREF
An IETF working group drafting a vocabulary for AI usage preferences and ways to attach them to content, in robots.txt or HTTP headers. Its vocabulary draft is draft-ietf-aipref-vocab-08, and it says "Preferences are not a security mechanism." See how agents discover what a store offers.
AP2 (Agent Payments Protocol)
A payment protocol its site calls "an open protocol for the emerging Agent Economy". Version 0.2 defines two signed authorisations, the Checkout Mandate and the Payment Mandate. Google donated it to the FIDO Alliance in April 2026. See how an agent pays.
API catalog
A list of a publisher's APIs at /.well-known/api-catalog, defined in RFC 9727 "to facilitate automated discovery and usage of published Application Programming Interfaces (APIs)". See how agents discover what a store offers and our API catalog check.
Bot management
Tools that tell automated traffic from people and decide what to do with it. Cloudflare's docs define bots as "automated software that sends requests to your site" and say its bot solutions "detect this automated traffic and let you decide how to respond." See why agents stall at checkout.
Buy for Me (Amazon)
An Amazon feature that buys from other brands' websites inside the Amazon Shopping app. Amazon calls it a "New beta feature" for "a subset of U.S. customers", and says it provides "the customer's encrypted name, address, and payment details to complete the checkout process on the brand's website." See what is agentic commerce?
CAPTCHA
A challenge meant to tell a person from a program; the name stands for "Completely Automated Public Turing Test, to Tell Computers and Humans Apart", as the W3C's Group Draft Note of 16 December 2021 spells it out. Our CAPTCHA check looks for one before the payment step.
Content Signals
Cloudflare's lines for robots.txt, "a set of machine-readable directives in a robots.txt file that categorize how crawlers may use your content", in three categories: search, ai-input and ai-train. Its site says some systems "may ignore these Content-Signal directives." See how agents discover what a store offers.
continue_url
The address in a UCP checkout where the buyer takes over from the agent. The specification says it "enables checkout handoff from platform to business UI, allowing the buyer to continue and finalize the checkout session", and that it "MUST be an absolute HTTPS URL". See UCP explained.
Copilot Checkout
Microsoft's checkout inside Copilot. On 8 January 2026 Microsoft wrote that it "is beginning to roll out in the U.S. on Copilot.com". See what is agentic commerce?
Crawler and agent
Two kinds of automated visitor (the split is ours). A training crawler collects pages in bulk: OpenAI's GPTBot "is used to crawl content that may be used in training our generative AI foundation models". An agent fetches because a person asked: Cloudflare calls agents "software acting on behalf of people". See bots, crawlers and agents.
Delegated payment
Handing an agent a limited right to pay instead of the card itself. OpenAI's Delegated Payment Spec "allows OpenAI to securely share payment details with the merchant or its designated payment service provider (PSP)"; in ACP, the delegate payment call returns a token limited by an allowance. See ACP explained.
Guest checkout
Buying without an account. BigCommerce's setting reads "Customers are not required to have an account to check out". An agent shopping for someone may have no account on your store, so a required sign-in can stop it. See our guest checkout check.
HTTP Message Signatures (RFC 9421)
A Standards Track RFC from February 2024 that defines "a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message". Web Bot Auth builds on it. See bots, crawlers and agents.
Instant Buy (Perplexity)
Perplexity's in-app purchase: it "lets U.S. users search for and buy products from a wide range of merchants directly on Perplexity", and "is currently available to all users in the United States." See what is agentic commerce?
Instant Checkout (ChatGPT)
OpenAI's name for buying inside ChatGPT. Its developer docs say "Supporting Instant Checkout in ChatGPT requires a merchant to implement three flows." Whether it is still offered is not published on the pages we could read. See ACP explained.
JSON-LD
The format Google recommends for structured data, which it describes as "A JavaScript notation embedded in a <script> tag" in the page. See how an AI agent reads a web page.
An HTTP response header, defined in RFC 8288, that points from one resource to another with a relation type, such as rel="api-catalog". A store can use it to point agents at its discovery files. See our Link headers check.
llms.txt
A proposed file at /llms.txt with background on a site and links to Markdown versions of its pages. It is a proposal by Jeremy Howard, "The /llms.txt file, v2", modified 10 August 2026, not a standards-body document. See our llms.txt check.
Mandate (AP2)
AP2's signed authorisation for a purchase. Version 0.2 says "AP2 defines two Mandate types: Checkout Mandate and Payment Mandate": the first goes to the merchant, the second to the credential provider and the card networks. See how an agent pays.
Markdown negotiation
Asking a server for a page as Markdown by sending Accept: text/markdown. Cloudflare's Markdown for Agents does this for enabled zones: it fetches the HTML "and convert it to Markdown before serving it to the client". See our Markdown check.
MCP (Model Context Protocol)
"an open protocol that enables seamless integration between LLM applications and external data sources and tools". Its current revision is 2026-07-28, and it is stewarded by the Agentic AI Foundation under the Linux Foundation. See MCP, A2A and WebMCP for stores.
MCP server card
A static document that describes a remote MCP server before anyone connects to it, defined in SEP-2127, which "has reached Final status" as an optional extension. A domain can list its cards in an AI Catalog at /.well-known/ai-catalog.json. See our MCP server card check.
Merchant Center
Google's product data service: "a free tool that helps millions of shoppers on Google discover, explore, and buy your products." Google's UCP checkout shows a Buy button only for listings with the native_commerce(checkout_eligibility) product attribute. See what is agentic commerce?
Merchant of record
The party that sells to the buyer and is responsible for the sale (our wording). UCP says "The business remains the Merchant of Record (MoR)", and ACP's site says businesses "maintain their customer relationships as the merchant of record". See UCP vs ACP vs MCP vs AP2.
MPP (Machine Payments Protocol)
Stripe describes it as "an open protocol that lets agents pay for your APIs and services programmatically without a checkout UI, co-authored by Stripe and Tempo". It uses HTTP status 402. See our MPP check.
Network token
A stand-in for a card number issued through the card networks. Adyen's docs say "A network token is 16-digit alternative for the Primary Account Number (PAN), and is unique per combination of shopper and merchant." See how an agent pays.
OAuth 2.0
The authorisation framework of RFC 6749 (Standards Track, October 2012), which "enables a third-party application to obtain limited access to an HTTP service". MCP's authorisation builds on it. See our OAuth metadata check.
Product feed
A structured file of your products sent to a platform (our wording). OpenAI's docs say product feeds "give ChatGPT the catalog data it needs to index your products", and that onboarding "is currently available to approved partners." See what is agentic commerce?
Product schema
The schema.org type for a product, defined as "Any offered product or service", with an Offer for price, currency and availability. It is what product structured data usually describes. See our product structured data check.
A Standards Track RFC from April 2025: "a metadata format that an OAuth 2.0 client or authorization server can use to obtain the information needed to interact with an OAuth 2.0 protected resource", by default at /.well-known/oauth-protected-resource. MCP authorisation requires it. See our protected resource check.
PSP (payment service provider)
The company that processes a store's card payments. ACP's terminology defines it as a "Service processing payment transactions (e.g., Stripe, Adyen)". See our payment provider check.
robots.txt
A file of crawl rules at the root of a site, standardised in RFC 9309 as rules "that crawlers are requested to honor". The RFC adds: "These rules are not a form of access authorization." See bots, crawlers and agents and our robots.txt check.
Shared Payment Token (SPT)
Stripe's token for agent purchases: "SPTs grant sellers scoped access to customers' payment methods for agent-initiated purchases". Stripe labels it a preview. See how an agent pays.
Google's product dataset. On 15 October 2026 Google said it holds "60+ billion continually refreshed product listings". See what is agentic commerce?
Signed agents and verified bots
Cloudflare's names for automated visitors it can identify. A verified bot "declares who it is deterministically, through a cryptographic Web Bot Auth signature, a published IP list with a stable user-agent, or reverse DNS", and Cloudflare says "Signed agents are now Verified As of July 1, 2026". See bots, crawlers and agents.
Structured data
Google: "Structured data is a standardized format for providing information about a page and classifying the page content". For a store, it is how a page states price and stock for a program to read. See how an AI agent reads a web page.
Trusted Agent Protocol (Visa)
Visa's "verifiable, cryptographic standard to help merchants differentiate legitimate agents from nefarious bots or web crawlers", which builds on RFC 9421. See how an agent pays.
UCP (Universal Commerce Protocol)
A commerce protocol Google calls "a new open standard for agentic commerce that works across the entire shopping journey", developed with Shopify. A store publishes its profile at /.well-known/ucp; the current release on GitHub is v2026-08-25. See UCP explained and our discovery check.
Universal Cart (Google)
Google's shopping cart. On 15 October 2026 Google said it "is rolling out in the U.S. across Google Search and in the Gemini app", with checkout "powered by the Universal Commerce Protocol (UCP)". See what is agentic commerce?
User agent
The name a program sends with each request. RFC 9110 says the header "contains information about the user agent originating the request"; the program declares it itself, so it can be copied. See bots, crawlers and agents.
Visa Intelligent Commerce
Visa's agent programmes, which Visa calls "our strategic portfolio for the age of AI agents". See how an agent pays.
Web Bot Auth
An IETF draft "to allow automated HTTP clients to cryptographically sign outbound requests, allowing HTTP servers to verify their identity with confidence." It is draft-ietf-webbotauth-httpsig-protocol-00, a working-group document. See bots, crawlers and agents and our key directory check.
WebMCP
A browser API that lets a page offer tools to agents: pages using it "can be thought of as Model Context Protocol [MCP] servers that implement tools in client-side script". It is a Draft Community Group Report, "not a W3C Standard". See our WebMCP check.
Well-known URI (RFC 8615)
The /.well-known/ path prefix for site-wide metadata, defined in RFC 8615. New names "MUST register" with IANA. UCP, A2A and API catalogs use it. See how agents discover what a store offers.
x402
A payment scheme over HTTP status 402 that its site calls an "open, neutral standard for internet-native payments", now run by the x402 Foundation. It is aimed at paying for APIs and content. See our x402 check.