Shop Pay Now Checks Out Inside AI Agents: Why the Card Credential Followed the Shopper

On 28 October, Shopify’s Fall ’26 Edition, “Exponential”, made a significant move in agentic commerce: Shop Pay checkout is now available inside personal AI agents, beginning with Muse from Meta, Claude Duet and Instinct. Claude Duet, Grok Bot and Instinct also offer Shop Pay for purchases from merchants that are not on Shopify.

The important change is not simply that an AI agent can complete a checkout. It is that a shopper’s established payment credential can travel with them into the agent, without being handed to it. For merchants, that makes agentic payments less about replacing cards with disposable credentials and more about extending trusted card payments into a new sales channel.

Shopify says Shop Pay uses tokens from Mastercard, Visa and Discover for agent purchases off Shopify, with American Express coming soon. The buyer’s card details are not shared with the agent. The company’s Fall ’26 merchant announcement describes the buyer as remaining in control of purchases.

What Shopify shipped, and why it matters

The distinction between on-platform and off-platform checkout matters. Muse, Claude Duet and Instinct bring Shop Pay into personal agents. For merchants outside Shopify, Claude Duet, Grok Bot and Instinct can also offer Shop Pay, extending the reach of this checkout beyond Shopify’s merchant base.

That puts Shop Pay in the path between the shopper and the agent. Rather than asking the agent to store or handle card details, the payment experience can use the shopper’s existing payment relationship and a tokenised credential. The agent can help the shopper select and buy; the credential itself remains protected.

Shopify is also working on how agents find and interpret a merchant’s offer. In Shopify admin, merchants can review their eligibility for Shopify Catalog and use the Knowledge base under Sales channels > Agentic to review and publish facts that agents may receive about their store, such as return windows, shipping destinations and gift services. Merchants can approve those facts before Shopify shares them.

Product presentation matters too. Shopify says badged products can rank higher in the Shopify Catalog data used by shopping agents. That makes catalogue accuracy, product attributes and clear policies part of agent readiness, not just housekeeping for a conventional storefront.

The developer release adds structured tools for agents to search products, update a cart and complete checkout after buyer approval. Shopify’s developer announcement describes those tools as available on Liquid and Hydrogen storefronts. For merchants, the strategic shift is that discovery and checkout may happen through an agent’s interface, while the merchant’s data and policies still shape whether the agent can confidently recommend and purchase.

The token fight: network tokens or virtual card numbers?

The timing is notable. On Mastercard’s Q3 2026 earnings call on 29 October, CEO Michael Miebach described virtual card numbers as a temporary bridge towards fully tokenised payments.

“A VCN is a processor decision that is a bridge to get ready for a fully tokenized transaction all the way through for a period of time,” he said. He added: “that’s not a long-term solution that we will support.” The comments were reported by PYMNTS.

A virtual card number can help protect the underlying card number by giving an agent or transaction a separate credential. It can also support transaction-specific restrictions, depending on how a provider implements it. Mastercard’s argument is that this is a transitional mechanism, not the end state.

A network token replaces sensitive card details with a token linked to the underlying card account. That link can help preserve the shopper’s existing payment preferences, rewards and controls. It can also support transaction traceability. It does not, by itself, decide the outcome of a dispute: dispute rights and resolution still depend on the transaction record, scheme rules and the parties’ processes.

Mastercard says Agent Pay supports agent verification and tokenised transactions. Miebach said Shop Pay uses Agent Pay and Mastercard network tokens, and a new agreement with OpenAI also includes Agent Pay. The wider direction is visible across the industry: Tencent and Visa’s new collaboration includes work on AI-powered commerce.

The strategic divide is now clear. Networks want agentic payments to carry the buyer’s card relationship, including its rewards and controls. Some processors are using virtual card numbers as a bridge. Merchants, meanwhile, need confidence that the transaction is authorised, traceable and manageable after checkout.

Merchants are setting their own rules

Payment technology is only part of the answer. Merchants are also deciding how an AI agent gets permission to shop.

Walmart is introducing Agent Profiles in November. Customers will be able to set per-agent spending caps of $50, $100 or $200, or require approval for every order. Its Agent Gateway is designed to let approved agents shop without seeing the customer’s card details.

Home Depot is taking an identity-led approach: it will support agents only if they identify themselves and confirm which customer they represent. These examples, reported by PYMNTS, show that merchant admission rules are becoming part of agentic commerce. One retailer may accept agents subject to spending limits, while another may require clear agent identification before allowing access.

For Australian merchants, that is a prompt to define the rules before agent traffic becomes a material operational issue. The question is not whether to accept every agent without conditions. It is whether your checkout, catalogue and policies are ready to serve legitimate agent-led demand while applying controls that fit your business.

What Australian merchants should do now

For more on the operational choices ahead, read Quantum Payments’ analysis of what merchants should do before agent traffic arrives, why local payment methods need a place in agentic commerce and the accountability gap slowing agentic payments.

Frequently asked questions

What is a network token?

A network token is a substitute for sensitive card details, linked to the underlying payment card. It can allow a payment to proceed without exposing the card number to the agent, while retaining a connection to the card account.

Do customers need a Shop Pay account for agents to buy?

Shop Pay is the checkout option in the announced agent experiences. Whether a customer can use it depends on the specific agent and purchase flow. Merchants should confirm the requirements of the channels they plan to support.

What does Mastercard Agent Pay do?

Mastercard Agent Pay is a framework for agentic transactions that includes agent verification and tokenised payments. Mastercard says it is being used by Shop Pay and is included in a new OpenAI agreement.

What should Australian merchants do first?

Start by reviewing how your products and policies appear to agents. If you use Shopify, check Catalog eligibility and publish accurate Knowledge base facts. Then test the payment and post-purchase flow end to end.

The credential decision is being made now. Merchants who publish clean agent-facing facts will be the ones agents can actually buy from.