Protocol profile
Visa Trusted Agent Protocol (TAP)
In short
Visa's agent identity scheme: an agent signs each HTTP request with HTTP Message Signatures (Web Bot Auth) so a merchant or its CDN can tell a registered agent from a bot and receive consented user and payment identifiers. For Visa TAP, merchant of record is n/a and dispute rules are none in spec.
Fact sheet
- Type
- Protocol
- Operator
- Visa
- Homepage
- github.com
- Matrix reach
- 0 live, 1 pilot, 5 announced, 0 not supported, 21 with no statement found
Readiness for merchants
Seven rows, each read from a primary source on 4 Nov 2026. The method page defines every row.
| Rubric row | Reading | Evidence | Source and read date |
|---|---|---|---|
| Specification public | Yes | Specification and sample code on GitHub. | github.com, 4 Nov 2026 |
| Reference implementation | Samples | GitHub sample agent and merchant code; Cloudflare validates signatures at the edge. | blog.cloudflare.com, 4 Nov 2026 |
| Live surfaces | None confirmed | No agent surface states that it signs requests with TAP in production. | usa.visa.com, 4 Nov 2026 |
| Processor support | Announced | Twelve PSPs and acquirers named as feedback partners; Worldpay announced a collaboration. | usa.visa.com, 4 Nov 2026 |
| Merchant of record | N/a | TAP identifies the agent; it does not change who sells. | github.com, 4 Nov 2026 |
| Dispute rules | None in spec | Disputes follow Visa Core Rules; TAP data can support evidence. | usa.visa.com, 4 Nov 2026 |
| Cost | No fee published | No merchant fee is published. | usa.visa.com, 4 Nov 2026 |
The row in full: every column
| Column | Status | Note | Source and read date |
|---|---|---|---|
| Stripe | announced | Named by Visa among early TAP partners giving feedback | investor.visa.com, 4 Nov 2026 |
| Adyen | announced | Named by Visa among early TAP partners giving feedback | investor.visa.com, 4 Nov 2026 |
| PayPal | no statement found | no statement found (2026-11-04) | developer.paypal.com, 4 Nov 2026 |
| Checkout.com | pilot | Agentic page lists TAP for agent identification; waitlist | checkout.com, 4 Nov 2026 |
| Braintree | no statement found | no statement found (2026-11-04) | developer.paypal.com, 4 Nov 2026 |
| Worldpay | announced | Worldpay collaborating with Visa and Cloudflare to advance TAP | worldpay.com, 4 Nov 2026 |
| Coinbase | announced | Visa named Coinbase an early TAP partner and is aligning TAP with x402 | investor.visa.com, 4 Nov 2026 |
| Crossmint | no statement found | no statement found (2026-11-04) | docs.crossmint.com, 4 Nov 2026 |
| Skyfire | no statement found | no statement found (2026-11-04) | docs.skyfire.xyz, 4 Nov 2026 |
| PayOS | no statement found | no statement found (2026-11-04) | payos.ai, 4 Nov 2026 |
| Shopify | no statement found | no statement found (2026-11-04) | shopify.dev, 4 Nov 2026 |
| BigCommerce | no statement found | no statement found (2026-11-04) | bigcommerce.com, 4 Nov 2026 |
| Salesforce CC | no statement found | no statement found (2026-11-04) | salesforce.com, 4 Nov 2026 |
| Adobe Commerce | no statement found | no statement found (2026-11-04) | experienceleague.adobe.com, 4 Nov 2026 |
| commercetools | no statement found | no statement found (2026-11-04) | docs.commercetools.com, 4 Nov 2026 |
| WooCommerce | no statement found | no statement found (2026-11-04) | woocommerce.com, 4 Nov 2026 |
| Amazon | no statement found | no statement found (2026-11-04) | aboutamazon.com, 4 Nov 2026 |
| Walmart | no statement found | no statement found (2026-11-04) | corporate.walmart.com, 4 Nov 2026 |
| Target | no statement found | no statement found (2026-11-04) | corporate.target.com, 4 Nov 2026 |
| Etsy | no statement found | no statement found (2026-11-04) | help.etsy.com, 4 Nov 2026 |
| Wayfair | no statement found | no statement found (2026-11-04) | aboutwayfair.com, 4 Nov 2026 |
| ChatGPT | no statement found | no statement found (2026-11-04) | chatgpt.com, 4 Nov 2026 |
| Google AI Mode | no statement found | no statement found (2026-11-04) | developers.google.com, 4 Nov 2026 |
| Perplexity | no statement found | no statement found (2026-11-04) | perplexity.ai, 4 Nov 2026 |
| Amazon Rufus | no statement found | no statement found (2026-11-04) | aboutamazon.com, 4 Nov 2026 |
| Meta Muse | no statement found | no statement found (2026-11-04) | about.fb.com, 4 Nov 2026 |
| Copilot | announced | Visa lists Microsoft among Trusted Agent Protocol contributors; no Copilot deployment stated. | usa.visa.com, 4 Nov 2026 |
| 1 live or pilot of 27 |
What Visa TAP does not do
- Does not move money or tokenise a card by itself.
- Does not replace bot management; it gives the WAF a verifiable identity to allow.
- Does not decide liability.
Sourced facts
- Visa announced Trusted Agent Protocol on 14 Oct 2025, developed with Cloudflare, available in the Visa Developer Center and on GitHub. usa.visa.com, read 4 Nov 2026.
- Visa says TAP is built on the HTTP Message Signature standard and aligned with the IETF Web Bot Auth work, using agent-specific cryptographic signatures. usa.visa.com, read 4 Nov 2026.
- Early feedback partners named by Visa: Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe and Worldpay. usa.visa.com, read 4 Nov 2026.
- The TAP README says the signature carries timestamps, a session identifier, key identifier and algorithm, is bound to the merchant domain and operation (browsing or payment), and can pass consented identifiers such as Payment Account References. github.com, read 4 Nov 2026.
- Cloudflare wrote on 24 Oct 2025 that both TAP and Mastercard Agent Pay use Web Bot Auth as the agent authentication layer, and that merchants can rely on Cloudflare to validate signatures (Signature-Input and Signature headers, Ed25519). blog.cloudflare.com, read 4 Nov 2026.
- The visa/trusted-agent-protocol repository was last pushed on 28 Oct 2025, so the public reference code has not moved in a year. github.com, read 4 Nov 2026.
- Visa Intelligent Commerce Connect accepts TAP alongside MPP, ACP and UCP, in pilot since April 2026. visa.co.uk, read 4 Nov 2026.
In the vendors section
- Nuvei, processor profile
- Visa, card network profile
- Cloudflare, rules or identity programme profile
- EMVCo, rules or identity programme profile
Compare and alternatives
Sources
- Visa Trusted Agent Protocol repository, read 4 Nov 2026
- Visa Introduces Trusted Agent Protocol, read 4 Nov 2026
- Cloudflare: Secure agentic commerce, read 4 Nov 2026
- Visa opens the door to AI-driven shopping (Intelligent Commerce Connect), read 4 Nov 2026
- Visa Core Rules and Visa Product and Service Rules, 24 October 2026, read 4 Nov 2026
- investor.visa.com/news/news-details/2025/Visa-Introduces-Trusted-Agent-Protocol-An-Ecosystem-Led-Framework-for-AI-Commer, read 4 Nov 2026
- checkout.com/agentic-commerce, read 4 Nov 2026
- worldpay.com/en/news/worldpay-collaborates-visa-and-cloudflare-advance-trusted-agent, read 4 Nov 2026
Last reviewed