Trusted Agent Protocol (TAP)
The Trusted Agent Protocol is Visa's framework for AI agents that shop on a customer's behalf. An agent signs each web request with its own cryptographic key, so a merchant can see that a registered agent is calling and whether it wants to browse or to pay. Visa developed it with Cloudflare. Dated events on payments are in the calendar below.
How the Trusted Agent Protocol works
Merchants block bots to stop fraud and scraping, and that also blocks the shopping agents their customers send. TAP gives the agent a stable identity in place of an IP address or user agent string, both of which are easy to fake. In Visa's description the agent can pass three signals: agent intent, which says that a trusted agent wants to look at or buy a product; consumer recognition, which says whether the customer already has an account with the merchant; and, as an option, payment information for the merchant's checkout.
Technically, TAP builds on Web Bot Auth and HTTP Message Signatures. Cloudflare's write-up explains the checks: the agent's public key sits in a directory that Visa hosts, a tag in the signature says whether the agent is browsing or paying, a timestamp limits how long the signature is valid, and a one-time value stops replays.
Who supports TAP
Visa named Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe and Worldpay as early partners. It aligns the work with the IETF, the OpenID Foundation and EMVCo, and says TAP complements the Agentic Commerce Protocol and works with x402. The first specifications cover the Visa network only.
Mastercard uses the same Web Bot Auth layer in Mastercard Agent Pay, and American Express builds its agent program on it as well. Merchants can therefore check agents of all three networks with the same signature method, while each network runs its own registry.
TAP in Europe
Visa's European Agentic Ready program uses the Trusted Agent Protocol and Visa's Agent Directory to give merchants a verified signal of agent identity, while Cloudflare and Akamai build the merchant side into their networks. The 31 issuers in the program include Commerzbank, comdirect and Deutsche Kreditbank, and every purchase was confirmed with a passkey for strong customer authentication.
TAP answers the merchant's question of which agent is calling. The issuer's question of what the customer allowed is answered by mandates such as those of the Agent Payments Protocol.
Upcoming payments events in Germany
What is the Trusted Agent Protocol?
The Trusted Agent Protocol is a Visa framework, built with Cloudflare, that lets AI agents identify themselves to merchants with cryptographic signatures and state whether they want to browse or to buy.
Does the Trusted Agent Protocol move money?
No. TAP identifies the agent and can carry optional payment information for the checkout. The payment itself runs over the card network as usual, with a token and the customer's authentication.
Where can developers find the specification?
Visa publishes it in the Visa Developer Center and on GitHub. Visa says availability differs by market while the product is rolled out.
Trusted Agent Protocol and Finance Loop
Finance Loop connects acquirers and AI developers in Germany who have to decide which agents they let through to the checkout. Finance Loop covers TAP next to AP2 and x402 in its Payments & Digital Money track. Payment firms can show their agent setup at a sponsored meetup or host an event with Finance Loop.
Finance Loop is a professional network and has the goal of driving the adoption of emerging technologies in finance, such as AI, digital payments, cloud and blockchain solutions. Finance Loop helps its members build skills and personal networks in these fields: Investment & Digital Assets, Payments & Digital Money, Digital Infrastructure & Sovereignty, and Risk & Compliance.