Skip to content
Free score
Agent checkout

Can an AI agent buy from your shop? Removing checkout friction for agents

Where AI agents stall between product page and payment, what the Agent Commerce Index found, and a ranked agent checkout audit you can run yourself.

By the ConversionVector teamUpdated 12 min read

Contents

Direct answer: An AI agent can buy from your shop only if it can get from a product page to a payable checkout without a step that needs a human. In our Agent Commerce Index Q4 2026, 8 of 116 basket-tested stores (7%) let a page-fetching agent reach checkout, and 96 (83%) let a browsing agent through. The blockers to check, in order, are bot protection on the checkout page, an add-to-basket action that only exists in JavaScript, variants an agent cannot select, forced account creation and captchas before payment. Fix them in that order, protect payment rather than the whole funnel, and support the platform or protocol checkouts where they exist in your markets.

This guide is for CRO leads, ecommerce managers and heads of digital at mid-market retailers selling in the US, the UK and Europe, and elsewhere. It applies checkout optimisation to a buyer that is not a person: what an agent can and cannot do at each step, what the Index found, and a ranked audit you can run on your own store.

Last verified: 30 October 2026 against OpenAI's Help Center, merchants page and crawler documentation, Google's Merchant Center Help, UCP developer guides and Shopping blog, Shopify's Help Center, Microsoft Advertising's agentic commerce page, Cloudflare's bots documentation and WooCommerce's developer documentation. Channel availability changes often, so check the current versions before you plan work.

Why checkout friction looks different for an agent

Classic checkout optimisation removes steps that make people give up: surprise delivery costs, forced registration, long forms. An agent does not get bored, but it fails hard on anything that assumes a human, and it fails silently. You see no abandoned basket, no session recording and no complaint. The shopper simply hears "I couldn't complete that purchase" and may be offered another shop.

There are three ways an agent reaches a purchase, and each fails in different places:

RouteHow it worksWhere it fails
Page-fetching agentRequests your pages over plain HTTP and reads the HTML your server returnsAnything rendered by JavaScript, any browser check, any captcha
Browsing agentDrives a real browser and clicks through like a personCaptchas, sign-in walls, one-time passcodes, ambiguous variant pickers, payment steps it is not allowed to take
Protocol or platform checkoutThe assistant checks out through an API (such as Google's UCP) or a platform channel, and the shopper confirms in the assistantEligibility: market, platform, product category and feed data

Browsing agents also have limits set by their makers. OpenAI's allowlisting article for ChatGPT Work's cloud browser says that "at launch, Cloud browser cannot sign in to websites or complete payments" (OpenAI Help Center). So for many agents today, the realistic goal is to reach a correct, priced checkout and hand over to the shopper, or to complete through a protocol route.

What the Index found

The Agent Commerce Index Q4 2026 measured 225 UK and US online retailers on 19 October 2026. Its basket test added one in-stock product to an anonymous basket as ChatGPT's agent and opened the checkout page. Nothing was ever submitted. Where the checkout turned the agent away, the same steps were repeated as an ordinary browser and, on Shopify, in a real browser.

  • 8 of 116 basket-tested stores let a page-fetching agent reach checkout.
  • 96 of 116 let a browsing agent through.
  • At 81 of the 88 stores reached only by the browsing agent, the published records say "the store created a checkout for the basket, but the checkout page was refused or challenged (403)". All 88 were Shopify stores, which is also the only platform where the Index re-ran the steps in a real browser.
  • 76 stores could not be basket-tested at all, because there was "no add-to-basket form in the page as served".
  • No store was marked "agents refused". The stores did not block the agent by name. What separated the two kinds of agent was how the request was made.

The per-store breakdown is a count of the published data file, and the Index measured one day and one agent identity. The page-fetching vs browsing agents guide explains the method and its limits in full, and the Agent Commerce Index explained covers how stores were scored.

The agent checkout audit

Work through the steps in order. Each row names the Agent Conversion Score check (specification v0.6) it maps to, what good looks like and how to test it. The order reflects how often each step stopped agents in the Index and how much of the funnel sits behind it.

#StepScore checkWhat good looks likeQuick test
1Product page is reachableACC-10, ACC-12HTTP 200 to agent user agents, no challenge pagecurl -A with an agent user agent
2Product facts are in the HTMLLEG-08, OFF-02Name, price, currency, stock and variant options in the server responseFetch and search the HTML for the price
3Variants are selectable without scriptTRX-09Each variant has its own ID and appears in structured dataCan you build a basket request for "navy, size L" from the HTML alone?
4Add to basket worksTRX-02, TRX-10A server-rendered form or a documented cart endpoint, open to agent trafficPost to it with a plain client and a cookie jar
5Checkout opensTRX-10HTTP 200 to agent identities at the first checkout stepRequest the checkout URL with the same cookies
6No forced accountTRX-01Guest checkout on, with sign-in optionalOpen checkout logged out
7No captcha before paymentTRX-03, ACC-12Challenges only at payment or on risk signalsLook for captcha scripts on basket and checkout pages
8Delivery cost and time are stated up frontOFF-04, OFF-05Delivery cost in structured data and delivery time on the product pageCheck the product JSON-LD for shippingDetails
9Payment methods are declaredTRX-08Accepted methods listed on the page or in markupSearch the page for payment method names
10Policies are one click awayTRU-02, LEG-09, LEG-10Delivery and returns pages linked from every product page and returning 200Fetch both links

1. Stop challenging the checkout page itself

This was the largest single blocker in the Index data. Checkout is where card testing and credential stuffing happen, so bot management tools often apply their strictest browser checks there. Those checks look for JavaScript execution, cookies and browser fingerprints, so a plain HTTP client fails by design, whatever it calls itself. The Index does not identify the mechanism at each store; this is our reading of the records.

What to do:

  • Move the strongest controls to payment submission and login, not to viewing the basket or the first checkout step. A request to see a checkout is low risk. A request to charge a card is not.
  • Verify agents instead of guessing. Signed requests with Web Bot Auth let your CDN tell a genuine agent from a script borrowing its name. Cloudflare's AI bot settings define its "Agent" category as "automated activity acting in real time on a person's behalf, such as chat fetch bots and browser-use agents" (Cloudflare), and OpenAI's cloud browser signs its requests and lists Akamai, Cloudflare, HUMAN and Vercel as providers that recognise it. Exempt verified agents from browser challenges on basket and checkout, and keep risk scoring on payment. Know Your Agent for retailers explains how the verification layers fit together.
  • Rate-limit on behaviour, not on a blanket rule. An agent may make several requests quickly. Limits tuned for human browsing can return HTTP 429 to a legitimate shopper's agent.
  • Hosted checkouts. If your platform hosts checkout (Shopify, for example), you may not control its bot protection. Test what agents receive, and use the platform's agent channels where they exist rather than fighting the hosted checkout. Shopify says its agentic storefronts are "active by default for eligible stores" (Shopify Help Center).

Are you blocking AI shopping agents? covers the access side: robots.txt, CDN rules and how to see what agents receive.

2. Put a real add-to-basket action in the HTML

For 76 stores in the Index, a page-fetching agent saw a product it could not add. Render the add-to-basket <form> on the server with the product or variant ID, even if JavaScript enhances it later. If your platform documents a cart API, keep it available to agent traffic. WooCommerce, for example, documents a public Store API that "provides public Rest API endpoints for the development of customer-facing cart, checkout, and product functionality".

3. Make variants explicit

An agent asked for "the navy one in large" has to map words to a purchasable item. A JavaScript picker that only reveals stock after a click is a guess for a fetching agent and a slow, error-prone task for a browsing one. Give every variant its own ID, mark it up with ProductGroup and hasVariant, and show stock per variant. See Product structured data for AI agents for the pattern.

4. Keep guest checkout on

Forced account creation stops browsing agents that cannot, or are not allowed to, create accounts and verify email addresses. It also costs you human customers. Make sign-in optional. If you need an account for loyalty or warranty, offer it after the order.

Platform channels make this explicit. Shopify's help for selling on Google AI Mode and Gemini says: "You can't require customers to sign in to their account before checkout" (Shopify Help Center).

5. Move captchas off the basket and checkout pages

A captcha on "add to basket" or on the delivery step is a wall for every agent. Keep challenges for payment submission, login and signals of abuse such as many failed cards. Score checks ACC-12 and TRX-03 test for challenge pages and captchas served to agents.

6. State the total before the agent has to ask

Agents compare offers. A shop that states delivery cost and time on the product page, and delivery cost in structured data, gives the agent a complete total to compare. One that reveals delivery at step three is either skipped or quoted wrongly. The shipping and returns markup is covered in Product structured data for AI agents.

Price display differs by market, so state it clearly: consumer prices include VAT in the UK and EU, and GST in Australia, while US and Canadian prices are normally shown before sales tax. Whatever you show, the structured price must match the price in the HTML (OFF-01).

7. Declare payment methods and keep the payment step standard

List accepted payment methods on product or basket pages (TRX-08). At payment, standard wallets and card forms are easier for a browsing agent to hand over to the shopper than bespoke widgets. Expect strong customer authentication in the UK and EU, such as 3-D Secure, to need the shopper. That is correct behaviour, not friction to remove.

Protocol and platform routes: checkout without your form

Where they are available, protocol and platform checkouts sidestep most of the steps above, because the assistant talks to a checkout through an API or a platform channel rather than filling in your form.

Route (as of 30 October 2026)WhereWhat it asks of you
Google UCP-powered checkout in AI Mode and GeminiProducts eligible in the US, Canada and Australia, "available for select merchants at this time" (Google Merchant Center Help). Google's developer guide says the UCP integration hub is rolling out in the US, "with Australia and Canada to follow early next year"; in May 2026 Google said UCP-powered checkout would come "later to the U.K." (Google)A Merchant Center account in good standing with approved free listings, return policies and customer support details, native_commerce(checkout_eligibility) set per product, and a UCP integration (Google for Developers)
Shopify direct checkout in AI channelsFor Google AI Mode and Gemini: you must sell to customers in the US, Canada or Australia, the store "can be based in any country", and direct checkout is "rolling out gradually" (Shopify Help Center). Shopify also offers direct checkout for Microsoft Copilot and Meta surfacesSettings in Shopify admin. Some features (such as custom pixels and product bundles), subscription-only products and local delivery or pickup are not supported in Google's direct checkout
Microsoft Copilot Checkout"Only English‑language merchants who sell to US buyers are eligible at this time (supporting USD)" (Microsoft Advertising)A Microsoft Merchant Center account and a UCP-compliant feed, or onboarding through PayPal or Stripe; Shopify merchants are enrolled automatically
ChatGPTShopping is live for users in the US. OpenAI says it is "moving away from a standalone Instant Checkout experience" and that "purchases are completed on merchant-owned websites or apps" (OpenAI)Your own checkout is the route, so steps 1 to 7 above apply in full. Shopify says ChatGPT users complete their purchase on your online store checkout

Three things follow. First, outside the US, Canada and Australia, your own checkout is the only agent route on these channels today, and even in those markets the protocol checkouts are limited to select merchants or rolling out gradually. The audit matters more, not less. Second, protocol checkouts exclude many products. Google's UCP guide lists subscriptions, personalised goods, pre-orders, final-sale items, items needing freight or other special shipping and age-restricted products among those ineligible for checkout. Your own checkout is the fallback for all of them. Third, OpenAI's Agentic Commerce Protocol currently "supports product discovery", with OpenAI saying it will expand "over time", so ChatGPT shoppers still end up on your checkout. See ACP vs UCP vs AP2 vs MCP for the protocol side.

How to test it yourself

Fetching path (ten minutes). Use a test product and your own store only.

URL="https://www.example.com/products/example"
UA="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
curl -s -c jar -b jar -A "$UA" -o pdp.html -w "PDP %{http_code}\n" "$URL"
grep -Eio '<form[^>]*(cart|basket)[^>]*>' pdp.html | head -3     # add-to-basket form served?
# Then send your platform's add-to-basket request with the same jar, and:
curl -s -c jar -b jar -A "$UA" -o checkout.html -w "checkout %{http_code}\n" "https://www.example.com/checkout"

The user agent above is the one OpenAI publishes for ChatGPT-User. A 403, a challenge page or an empty shell is what a fetching agent gets. Your network is not the agent's network, and an unsigned request is not a verified agent, so treat this as a first screen and confirm in your CDN's security events.

Browsing path. Ask a browsing agent to buy a named variant and stop before payment. Note every point where it hesitates, asks for help or fails: the variant picker, the delivery step, a sign-in prompt, a challenge page.

Protocol path. Check eligibility per channel and market in the table above, and check your product diagnostics in Merchant Center.

Common mistakes

  • Testing only as yourself. Your browser passes every check that stops an agent.
  • Treating the problem as "AI bots". In the Index basket test, no store refused the agent by name. How the request was made decided the outcome.
  • Removing fraud controls wholesale. Verify agents and challenge on risk. Do not open payment to everyone.
  • Fixing checkout but not the product page. If the price and add-to-basket action are not in the HTML, a fetching agent never gets to checkout.
  • Assuming a protocol route covers everything. Category exclusions and market limits mean your own checkout is still the fallback.
  • Hiding delivery cost until checkout. An agent comparing totals cannot compare what it cannot see.

Sources

Questions

Can AI agents complete a purchase on my website today?
Some can reach checkout, but few stores let every kind of agent through. In our Agent Commerce Index Q4 2026, 8 of 116 basket-tested stores let a page-fetching agent reach checkout, against 96 for a browsing agent. Many agents also stop short of paying by design: OpenAI says the cloud browser in ChatGPT Work cannot sign in to websites or complete payments at launch. Where an assistant does complete a purchase itself, it is usually through a platform or protocol route, such as Google's UCP-powered checkout or Shopify's direct checkout in AI channels, in the markets where those are available.
What is the biggest checkout blocker for AI agents?
In the Index basket test it was the checkout page itself. At 81 of the 88 stores that only a browsing agent got through, the store created a checkout for the basket and then refused or challenged the checkout page when it was requested without a real browser. The next thing to check is whether the add-to-basket form is in the HTML at all: at 76 stores it was not, so the basket test could not run.
Should I remove the captcha from my checkout?
Not wholesale. Move challenges to where the risk is, such as payment submission and login, and exempt agents that prove who they are with signed requests (Web Bot Auth). Keep fraud scoring on payment. The aim is to stop abuse, not shopping.
Does an agent need to pay on my site?
It depends on the channel. On Google's UCP-powered checkout, which applies to products eligible in the US, Canada and Australia and is open to select merchants, the shopper checks out with Google Pay on Google's surfaces and you remain the merchant of record. In ChatGPT, OpenAI says purchases are completed on merchant-owned websites or apps. Your own checkout is the fallback on every channel and the only route in markets the protocol checkouts do not yet cover.
How do I test whether an agent can buy from my store?
Run three tests: request a product page, your basket and your checkout without a browser and check what comes back; ask a browsing agent to buy a specific variant and note where it stalls; and run the free Agent Conversion Score, which for physical-goods stores adds one product to an anonymous basket, opens checkout and stops, without logging in, entering personal or payment details or placing an order.

Published . Last updated . More in Agent checkout and the guide library.

Related guides