Securing agentic commerce: helping AI Agents transact with Visa and Mastercard

Agentic commerce needs a trust layer

AI agents are beginning to shop, compare, and buy on behalf of consumers. That shift introduces a new security problem for merchants: how do they tell an approved shopping agent from a scraper or a bot that is trying to abuse their storefront? Cloudflare is partnering with Visa and Mastercard to help solve that problem. Visa has developed the Trusted Agent Protocol, and Mastercard has built Agent Pay. Both are designed to help merchants recognize legitimate, registered agents—and both rely on Web Bot Auth as the authentication layer.

Merchants face three basic questions when an agent shows up: Is this a helpful, approved agent or a malicious bot? Is the agent acting for a known customer or a stranger? And what instructions did the consumer give their agent? The Visa and Mastercard protocols aim to answer those questions by tying agent identity to payment network accounts.

Why existing bot detection isn't enough

Traffic from agents has historically been classified by user agent strings and IP addresses. Both can be spoofed, which leads to bad classifications and misapplied bot mitigation. Web Bot Auth addresses that by using HTTP Message Signatures with public key cryptography, giving each agent a stable identifier that cannot be faked.

Working with Visa and Mastercard, Cloudflare found that Web Bot Auth could serve as the foundation for commerce-specific agent validation. The resulting protocols give merchants three capabilities:

• Identify a registered agent and distinguish a browsing request from a payment request.
• Link the agent to a consumer identity through the payment network.
• Let merchants indicate how payment should happen: network token, guest checkout, or micropayment.

That helps merchants recognize a trusted agent at two critical moments: during the browsing phase, when the agent is checking product details and final costs, and at the payment interaction, when the purchase is completed.

How the protocols authenticate agents

The system depends on several parties working together. Agent developers build the shopping agents. Merchants need to know whether a request is legitimate. Networks like Cloudflare verify the agent's signatures. Payment networks like Visa and Mastercard link cardholder identity to the transaction.

Both Visa and Mastercard built on Web Bot Auth to specify how agents attach cryptographic signatures to HTTP requests. Agents must register and have their public keys—referenced as the keyid in the Signature-Input header—placed in a well-known directory. To start, Visa and Mastercard will each host directories for agents registered with their respective networks.

Both protocols add a new tag that agents must include in the Signature-Input header, indicating whether the agent is browsing or purchasing. Merchants can use that tag to decide whether to interact with the agent. Agents must also include a nonce field, a unique sequence in the signature that provides replay protection. A browsing request from an agent acting for a Visa cardholder looks like this:

GET /path/to/resource HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 Chrome/113.0.0 MyShoppingAgent/1.1
Signature-Input: 
  sig2=("@authority" "@path"); 
  created=1735689600; 
  expires=1735693200; 
  keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"; 
  alg="Ed25519";   nonce="e8N7S2MFd/qrd6T2R3tdfAuuANngKI7LFtKYI/vowzk4IAZyadIX6wW25MwG7DCT9RUKAJ0qVkU0mEeLEIW1qg=="; 
  tag="web-bot-auth"
Signature: sig2=:jdq0SqOwHdyHr9+r5jw3iYZH6aNGKijYp/EstF4RQTQdi5N5YYKrD+mCT1HA1nZDsi6nJKuHxUi/5Syp3rLWBA==:

The protocols are designed so merchants don't have to change their infrastructure to benefit. Merchants set the rules for agent interactions on their site, and Cloudflare acts as the validator. For each request, Cloudflare performs the following checks:

1. Confirm the presence of the Signature-Input and Signature headers.
2. Pull the keyid from the Signature-Input header. If the key hasn't been fetched and cached, retrieve it from the public key directory.
3. Check that the current time falls between the created and expires timestamps.
4. Check the nonce against the cache for uniqueness, rejecting reused or expired signatures.
5. Validate the tag per the protocol: agent-browser-auth for browsing, agent-payer-auth for paying.
6. Reconstruct the canonical signature base from the Signature-Input components.
7. Perform cryptographic ed25519 signature verification with the key from keyid.

Visa's validation flow is illustrated here:

Mastercard's Agent Pay flow follows the same pattern:

Bringing support to Cloudflare's Agent SDK and managed rules

Cloudflare's Agent SDK already supports x402 transactions, letting developers build agents that can transact. Over the coming months, Cloudflare will work with Visa and Mastercard to bring support for their protocols directly into the Agent SDK. That would let developers manage their registered agent's private keys and generate the correct HTTP message signatures for browsing and transacting on merchant sites. A request handled inside a Cloudflare Worker would look something like this:

/**
 * Pseudocode example of a Cloudflare Worker acting as a trusted agent.
 * This version explicitly illustrates the signing logic to show the core flow. 
 */

// Helper function to encapsulate the signing protocol logic.
async function createSignatureHeaders(targetUrl, credentials) {
    // Internally, this function would perform the detailed cryptographic steps:
    // 1. Generate timestamps and a unique nonce.
    // 2. Construct the 'Signature-Input' header string with all required parameters.
    // 3. Build the canonical 'Signature Base' string according to the spec.
    // 4. Use the private key to sign the base string.
    // 5. Return the fully formed 'Signature-Input' and 'Signature' headers.
    
    const signedHeaders = new Headers();
    
    signedHeaders.set('Signature-Input', 'sig2=(...); keyid="..."; ...');
    signedHeaders.set('Signature', 'sig2=:...');
    return signedHeaders;
}

export default {
    async fetch(request, env) {
        // 1. Load the final API endpoint and private signing credentials.
        const targetUrl = new URL(request.url).searchParams.get('target');
        const credentials = { 
            privateKey: env.PAYMENT_NETWORK_PRIVATE_KEY, 
            keyId: env.PAYMENT_NETWORK_KEY_ID 
        };

        // 2. Generate the required signature headers using the helper.
        const signatureHeaders = await createSignatureHeaders(targetUrl, credentials);

        // 3. Attach the newly created signature headers to the request for authentication.
        const signedRequestHeaders = new Headers(request.headers);
        signedRequestHeaders.set('Host', new URL(targetUrl).hostname);
        signedRequestHeaders.set('Signature-Input', signatureHeaders.get('Signature-Input'));
        signedRequestHeaders.set('Signature', signatureHeaders.get('Signature'));

       // 4. Forward the fully signed request to the protected API.
        return fetch(targetUrl, { headers: signedRequestHeaders });
    },
};

Cloudflare also plans new managed rulesets so customers can allow agents using the Trusted Agent Protocol or Agent Pay. A store owner who wants to block most automated traffic but accept authorized agents could enable a rule that automatically lets through registered Visa or Mastercard agents while still applying other bot protection and WAF rules.

The protocols will continue to evolve as feedback comes in from implementers. American Express will also be using Web Bot Auth as the foundation for its own agentic commerce offering.

Getting started

Developers can begin building with Cloudflare's Agent SDK today. Sample implementations are available for the Trusted Agent Protocol, and documentation is published for both the Trusted Agent Protocol and Agent Pay.