# Guest checkout and AI agents: let an agent buy without an account

Why an AI shopping agent needs guest checkout, where each platform keeps the setting, and how to check what your checkout entry shows, with a path simulator and a checker.

By Valerii Checha, 3 Nov 2026

Do AI shopping agents need guest checkout? An agent buying for someone has no customer account of its own at your store, so in our reading a checkout that requires one stops it unless the shopper steps in and signs in. Turn guest checkout on, make the checkout entry a form or a visible "Continue as guest" button that works without scripts, and keep CAPTCHAs off the way in.

This guide shows where a checkout can stop an agent, where each platform keeps the setting, and how our scan reads your checkout entry, with a checker you can paste your own page into. Storewalk is ours: we build the scan, and its [guest checkout](https://storewalk.ai/checks/TRX-001) and [CAPTCHA](https://storewalk.ai/checks/TRX-002) checks are ours. The platforms, UCP, Cloudflare and Anthropic are quoted from their own pages, read on 3 November 2026. For the wider picture of checkout walls, read [why agents stall at checkout](https://storewalk.ai/blog/why-agents-stall-at-checkout), and for all five walls an agent meets, [the hub article](https://storewalk.ai/blog/why-agents-cant-buy).

## Why does guest checkout matter to an AI agent?

Because the agent is a guest. When a shopper asks an assistant to buy something, the assistant arrives at your checkout the way a first-time visitor does, with a basket and no login. If the next page is a sign-in form, the agent can stop and ask the shopper to sign in, or hand over, or give up. None of those ends with an order placed by the agent. It is a bit like asking a courier for the recipient's library card.

[UCP](https://storewalk.ai/blog/ucp-explained), the Universal Commerce Protocol, puts guest checkout in the same place. Its identity linking page lists three access levels, and at the middle one, "Agent-authenticated", an agent's own platform credentials are enough for "Guest checkout, create a cart". A shopper's sign-in comes later and adds things: the page says "identity linking upgrades the experience, it does not gate it." A store can still refuse guests in UCP. The spec's own example is a wholesaler with "No guest checkout", where "every transaction requires an authenticated user". That is a choice for a business that sells only to approved buyers. For a shop that sells to anyone, we see little reason to make it.

## Where can a checkout stop an agent?

At the checkout entry, mostly. The figure walks a basket from cart to order. Choose how your store handles accounts, what the checkout entry shows and whether a challenge sits on it, and see where an agent without an account stops. Under the steps are the verdicts our two checks give the checkout entry those choices describe.

A checkout path, step by step: where an agent without an account stops.

On the page, you choose the sign-in setting, what the checkout entry shows and any challenge on it, and see the five steps from cart to order. Where an agent stops is our reading; the verdicts come from running the checks’ rules on the checkout entry page those choices describe.

- Accounts optional, straight to the form, challenge: None: an agent without an account reaches the order. TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Accounts optional, sign-in page with a guest button, challenge: None: an agent without an account reaches the order. TRX-001 PASS, Checkout offers a guest option ("/checkout/guest"); TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Accounts optional, sign-in page, guest in a sentence, challenge: None: an agent without an account stops at checkout entry (The page says guests are welcome but gives the agent nothing to click.). TRX-001 PASS, Checkout offers a guest option ("Guest checkout"); TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Sign-in required, challenge: None: an agent without an account stops at checkout entry (A sign-in form, and the agent has no account of its own. The shopper would have to sign in.). TRX-001 FAIL, Checkout redirects to login with no guest option; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- WooCommerce Modern Login, challenge: None: an agent without an account stops at checkout entry (WooCommerce: with Modern Login “the checkout form is only shown after the user is logged in”.). TRX-001 FAIL, Checkout entry is a login form with no guest option; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Accounts optional, straight to the form, challenge: Score-based reCAPTCHA (v3): an agent without an account may stop at checkout entry (Nothing to click, but the score can refuse an agent without saying so.). TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 WARN, invisible/score-based CAPTCHA on checkout; it may refuse an agent without showing a challenge.
- Accounts optional, straight to the form, challenge: Turnstile widget: an agent without an account may stop at checkout entry (Managed Turnstile asks for a click only when its check needs one, and then the agent stops.). TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 FAIL, interactive CAPTCHA on checkout before payment.
- Accounts optional, straight to the form, challenge: reCAPTCHA checkbox (v2): an agent without an account stops at checkout entry (A box to tick. Anthropic: “we will not attempt to bypass CAPTCHAs for the sites we crawl.”). TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 FAIL, interactive CAPTCHA on checkout before payment.
- Accounts optional, straight to the form, challenge: Bot manager’s challenge page: an agent without an account stops at checkout entry (Cloudflare: “The visitor cannot reach their destination without passing the challenge.”). TRX-001 SKIPPED, Could not read the checkout entry: bot management answered instead of the shop; TRX-002 FAIL, interactive CAPTCHA on checkout before payment.
- Accounts optional, straight to the form, challenge: Bot manager refuses (403): an agent without an account stops at checkout entry (The store’s page never arrives; bot management answers instead.). TRX-001 SKIPPED, Could not read the checkout entry: bot management answered instead of the shop; TRX-002 SKIPPED, Could not read the checkout: bot management answered instead of the shop.
- Accounts optional, straight to the form, challenge: Only when the order is submitted: an agent without an account may stop at payment (A challenge when the order is submitted. Our scan never gets this far, so no check of ours sees it.). TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.

Sources: [Shopify Help Center: Editing the checkout form options](https://help.shopify.com/en/manual/checkout-settings/checkout-form-options) and [WooCommerce docs: Configuring Cloudflare Turnstile (Enhanced Customer Accounts)](https://woocommerce.com/document/enhanced-customer-accounts/configuring-cloudflare-turnstile/).

With sign-in required, the agent meets a form it cannot fill in, because the account is the shopper's. WooCommerce's Enhanced Customer Accounts documentation offers a stricter mode still: with "Modern Login" on checkout, "the checkout form is only shown after the user is logged in, reducing exposure to spam and bots." That trades guest access for bot protection, and an agent is the sort of visitor that trade leaves outside.

A checkbox CAPTCHA is a wall in its own right. Anthropic says of its bots: "we will not attempt to bypass CAPTCHAs for the sites we crawl." Cloudflare's managed Turnstile "will only require interaction if a further check is necessary to verify that the visitor is human", so whether it stops an agent depends on the visit. A challenge page from a bot manager stops it before your checkout even loads: Cloudflare writes that "The visitor cannot reach their destination without passing the challenge." The [agent readiness checklist](https://storewalk.ai/guides/agent-readiness-checklist) puts these beside the other walls a store can put up.

## How do you turn on guest checkout on your platform?

Every platform here has a switch. Only Magento's help page says which way it starts.

Where each platform keeps the guest checkout setting, in its own words.

Shopify. Where: Settings > Checkout, with the customer contact method options. Options: “Select whether to require customers to sign in to their customer account before checking out.”. Default: Not stated. The page gives defaults for other options on new stores, such as “Email is selected by default on new stores”, and none for this one. Turning guests off: “Customers can only use an email address to check out when signing in is required”, and “accelerated checkout options such as Apple Pay aren’t displayed in the online store cart”.

Source: [Shopify Help Center: Editing the checkout form options](https://help.shopify.com/en/manual/checkout-settings/checkout-form-options).

WooCommerce. Where: WooCommerce > Settings > Accounts & Privacy, under Checkout. Options: “Enable guest checkout: Allow customers to check out without creating an account.”; “Enable log-in during checkout: Allow customers to log in to an existing account during checkout.”. Default: The help page states none. In WooCommerce’s source the setting is labelled “Enable guest checkout (recommended)” with a default of yes. Turning guests off: “Customers still need an account to purchase subscriptions.” Separately, the Enhanced Customer Accounts docs suggest Modern Login, where “the checkout form is only shown after the user is logged in”.

Sources: [WooCommerce docs: Accounts and Privacy settings](https://woocommerce.com/document/configuring-woocommerce-settings/accounts-and-privacy/) and [WooCommerce docs: Configuring Cloudflare Turnstile (Enhanced Customer Accounts)](https://woocommerce.com/document/enhanced-customer-accounts/configuring-cloudflare-turnstile/).

BigCommerce. Where: Settings › Checkout, in the Customer accounts part of General settings. Options: “Customers are not required to have an account to check out”; the same, “but automatically create one after ordering”; “Customers must have or create an account to check out”. Default: Not stated; none of the three is labelled the default. Turning guests off: With guest checkout off, wallets such as PayPal and Apple Pay “are only available for signed in customers on product and cart pages”.

Source: [BigCommerce Help Center: Guest Customers and Checkout](https://support.bigcommerce.com/articles/Public/Guest-Customers-and-Checkout).

Magento and Adobe Commerce. Where: Stores > Configuration > Sales > Checkout > Checkout Options > Allow Guest Checkout. Options: Allow Guest Checkout: Yes or No.. Default: “The default setting allows guests to make purchases”. Turning guests off: With it set to No, shoppers must “open an account before making a purchase”. The page names no other restriction.

Source: [Adobe Experience League: Guest checkout](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/point-of-purchase/checkout/checkout-guest).

On Shopify, the switch sits with the customer contact options under Settings > Checkout, and Shopify's page gives no default for it, so look. It also tells you what you lose with sign-in required: "accelerated checkout options such as Apple Pay aren't displayed in the online store cart". On WooCommerce, the box is "Enable guest checkout" under WooCommerce > Settings > Accounts & Privacy; the help page states no default, and the plugin's own source marks it "(recommended)" and on. Subscriptions are the exception, since "Customers still need an account to purchase subscriptions." BigCommerce offers three choices and labels none of them the default. Magento says "The default setting allows guests to make purchases". The [Shopify](https://storewalk.ai/shopify), [WooCommerce](https://storewalk.ai/woocommerce), [BigCommerce](https://storewalk.ai/bigcommerce) and [Magento](https://storewalk.ai/magento) guides have the rest of each platform's settings.

## What should the checkout entry page show?

The simplest checkout entry is the form itself: email, address, delivery, then payment, with no password field. The next best is a sign-in page with a real link or button to continue as a guest. For that page:

- Make the guest option a link, a button or a form, with words such as "Continue as guest". A sentence that says guests are welcome gives an agent nothing to press.
- Put it in the HTML your server sends. A button that only appears after a script runs may never appear to an agent that runs no scripts.
- Keep "Sign in for faster checkout" as an offer beside the guest option, never in place of it.

To see what our checks make of your own checkout entry, open it in a browser with something in the basket, view the source, and paste it here. The examples show the cases the checks tell apart.

Check your checkout entry: what our guest checkout and CAPTCHA checks find.

On the page, you paste your checkout entry page’s HTML and the address it ended at, and see what our TRX-001 and TRX-002 find. The examples:

- Straight to the form: TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Sign in, or a guest button: TRX-001 PASS, Checkout offers a guest option ("/checkout/guest"); TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Guest checkout in a sentence: TRX-001 WARN, Guest checkout is mentioned ("Guest checkout") but nothing on the page can be clicked to reach it; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Sign in to check out: TRX-001 FAIL, Checkout redirects to login with no guest option; TRX-002 PASS, No CAPTCHA widget on cart or checkout for an anonymous visitor.
- Form with a reCAPTCHA box: TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 FAIL, interactive CAPTCHA on checkout before payment.
- Form with score-based reCAPTCHA: TRX-001 PASS, Checkout entry takes an address and payment without asking for a password; TRX-002 WARN, invisible/score-based CAPTCHA on checkout; it may refuse an agent without showing a challenge.

## What does an agent-ready checkout look like with UCP and MCP?

On some platforms an agent can skip your checkout pages and use the platform's own tools. Shopify's Checkout MCP, a set of checkout tools that agents call through MCP (the Model Context Protocol, in our words a standard way for AI apps to call tools on a server), implements UCP's checkout. It is for agents that authenticate or sign their requests: "All requests require authentication or a signed request." From the shopper it asks for no customer account. It asks for a way to reach them: "Contact method email or phone_number must be provided, per-merchant configuration." When the buyer has to finish the purchase themselves, it hands the buyer a link: "When the session is ready for the buyer to finish on the storefront, present the continue_url." The page never uses the word "guest". In our reading, that link opens your ordinary storefront checkout, so a sign-in requirement there would meet the shopper at the very end.

BigCommerce's Storefront MCP says its "catalog, cart, and checkout tools stay available to every session on a B2B-enabled store too, including guests". [MCP, A2A and WebMCP for stores](https://storewalk.ai/blog/mcp-a2a-webmcp-for-stores) explains what these servers are.

## What do our checks read, and where do they fall short?

Our [TRX-001](https://storewalk.ai/checks/TRX-001) reads the cart and checkout entry it can reach without buying anything. It passes a page that offers a guest link, button or form, or that takes an address with no password field. It fails a checkout that redirects to a sign-in address, says an account is required, or shows only a login form. It warns when guest checkout is mentioned with nothing to click. Our [TRX-002](https://storewalk.ai/checks/TRX-002) fails an interactive CAPTCHA on the cart or checkout and warns on a score-based one. A refusal from a bot manager makes TRX-002 skip, since we did not see your checkout. TRX-001 skips too, except on Shopify and BigCommerce, where it falls back to the platform default described below.

The limits below are ours.

- Our scan's basket is always empty, so on many stores it never reaches a checkout entry. Outside Shopify and BigCommerce, TRX-001 then skips rather than guess.
- On Shopify and BigCommerce, when nothing we read contradicts it, TRX-001 passes on optional accounts as the platform default. Neither platform's help page states that default today, so the pass is weaker than it reads.
- TRX-001 is generous with guest words. A sign-in page that says "Guest checkout is available" next to an email box passes, because the email box counts as a form an agent can use. The checkout path figure shows that case passing while the agent stops.
- TRX-002 cannot see a Turnstile widget's mode from the page (in Cloudflare's docs the mode is part of the widget's configuration), so it treats any Turnstile widget on the cart or checkout as interactive and fails it. A managed or invisible Turnstile may never ask anything of an agent, so on that point the scan is stricter than the widget.

Neither check sees a challenge that only appears when the order is submitted, because our scan never submits an order. A separate check, [VER-003](https://storewalk.ai/checks/VER-003), compares the controls on your checkout with those on your product pages.

## Frequently asked questions

### Can an AI agent sign in to a customer account?

Not with an account of its own at your store. The account belongs to the shopper, so a required sign-in leaves it to the shopper. UCP defines a way for a shopper to link their account to an agent with OAuth, a sign-in at the store that gives the agent a limited token; [why agents stall at checkout](https://storewalk.ai/blog/why-agents-stall-at-checkout) explains it. UCP describes that link as an upgrade, with guest checkout available without it.

### Is guest checkout on by default?

On Magento, yes: Adobe says "The default setting allows guests to make purchases". WooCommerce's source marks it on and "(recommended)". Shopify's and BigCommerce's help pages state no default, so check your own settings.

### Does turning off guest checkout cost anything besides agents?

On Shopify, with sign-in required, "accelerated checkout options such as Apple Pay aren't displayed in the online store cart". On BigCommerce, with guest checkout off, wallets such as PayPal and Apple Pay "are only available for signed in customers on product and cart pages".

### Should I put a CAPTCHA on my checkout?

Not on the way in. Anthropic says its bots will not try to get past one, and our TRX-002 fails an interactive CAPTCHA on the cart or checkout. If you need protection, use a check that scores visits without asking anything, or challenge only when the order is submitted.

### How do I check what my checkout shows?

Add something to the basket, open the checkout in a browser, view the page source and paste it into the checker above. Then run a scan to see what the checks find on your live store.

The sources below were last checked on the date shown.

## Sources

- [Shopify Help Center: Editing the checkout form options](https://help.shopify.com/en/manual/checkout-settings/checkout-form-options)
- [WooCommerce docs: Accounts and Privacy settings](https://woocommerce.com/document/configuring-woocommerce-settings/accounts-and-privacy/)
- [WooCommerce docs: Configuring Cloudflare Turnstile (Enhanced Customer Accounts)](https://woocommerce.com/document/enhanced-customer-accounts/configuring-cloudflare-turnstile/)
- [WooCommerce source: class-wc-settings-accounts.php](https://raw.githubusercontent.com/woocommerce/woocommerce/trunk/plugins/woocommerce/includes/admin/settings/class-wc-settings-accounts.php)
- [BigCommerce Help Center: Guest Customers and Checkout](https://support.bigcommerce.com/articles/Public/Guest-Customers-and-Checkout)
- [Adobe Experience League: Guest checkout](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/point-of-purchase/checkout/checkout-guest)
- [UCP Identity Linking, 2026-08-25](https://ucp.dev/2026-08-25/specification/common/identity-linking/)
- [Shopify.dev: Checkout MCP](https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp)
- [BigCommerce developer docs: MCP overview](https://docs.bigcommerce.com/developer/api-reference/mcp/overview)
- [Cloudflare docs: Turnstile widgets](https://developers.cloudflare.com/turnstile/concepts/widget/)
- [Cloudflare docs: Challenge pages](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/)
- [Anthropic: Does Anthropic crawl data from the web?](https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler)

Last checked 3 Nov 2026