Mastercard + Alchemy: How Should E-commerce Stores Prepare for AI Agents That Can Actually Pay?

AI agents are becoming increasingly capable of doing more than finding products and recommending what to buy. They are moving toward actually completing purchases on behalf of users.

That makes Mastercard's work on agentic payments particularly relevant for e-commerce businesses. Mastercard has been developing its Agent Pay framework around agent identity, consumer authorization, tokenized payment credentials, and transaction controls, while Alchemy's AgentCard provides infrastructure for AI agents to make payments. Their integration brings these capabilities closer to real-world agentic commerce.

For merchants, this creates a new question:

How do you safely accept a transaction initiated by software rather than directly by a human?

From AI Shopping to AI Purchasing

Traditional e-commerce looks like:

Customer → Store → Checkout → Payment

Agentic commerce introduces another layer:

Customer → AI Agent → Store → Payment

Consider a customer telling an AI agent:

"Find me running shoes under $150 and order them if they can arrive before Friday."

The agent could search products, compare prices, check availability, select a product, create a cart, and potentially complete payment.

The challenge is that the merchant now needs to trust and control an automated actor that is making decisions on behalf of a customer.

This is fundamentally different from simply adding an AI chatbot to an online store.

1. Agent Identity

The first question is simple:

Who is making this request?

Traditional e-commerce security focuses heavily on authenticating customers. Agentic commerce introduces another identity to consider: the AI agent.

Merchants will increasingly need mechanisms to determine whether an automated request comes from a legitimate agent, who operates that agent, and whether it is authorized to act for a particular customer.

This is why agent identity and verification are becoming important parts of emerging agentic-payment frameworks.

2. Authorization and Spending Limits

An AI agent should not receive unrestricted access to a customer's payment card.

Instead, the customer should be able to delegate limited authority to the agent.

For example:

Maximum purchase: $200 Daily spending limit: $500 Allowed category: Electronics Human approval: Required above $200 Shipping: Saved addresses only

The important principle is:

The AI should make decisions, but infrastructure should enforce financial boundaries.

If an agent accidentally selects a $2,000 product, the backend should reject the transaction even if the AI decides that the purchase is appropriate.

[IMAGE PLACEHOLDER — Agent authorization and spending-limit UI]

3. Your Commerce APIs Become More Important

AI agents may not interact with a store in the same way humans do.

Instead of navigating:

Product page → Add to cart → Checkout

an agent may need:

Search products → Check inventory → Create cart → Calculate shipping → Authorize payment → Create order

This means merchants should start treating their commerce APIs as a first-class customer interface.

A good agent-ready commerce platform should provide controlled access to:

• Products
• Pricing
• Inventory
• Carts
• Shipping
• Orders
• Returns
• Payments

The goal isn't to give an AI agent access to your entire backend. It is to expose carefully controlled commerce capabilities.

4. Payment Tokenization

Payment credentials are one of the biggest security concerns in agentic commerce.

An AI agent should not need access to a customer's raw card number simply to purchase something.

Tokenization provides a safer model. The agent can operate using a controlled payment credential while the underlying financial credentials remain protected.

Mastercard's Agent Pay approach uses agentic tokens as part of its payment architecture, while Alchemy's AgentCard provides payment capabilities specifically designed for agents.

For merchants, this means the payment layer needs to evolve from simply asking:

"Is this card valid?"

toward also considering:

"Is this transaction being performed by an authorized agent?"

5. Fraud and Disputes Will Change

Agentic commerce also changes how merchants think about fraud.

Today, automated traffic is often treated as suspicious. But in an agentic-commerce environment, some automated traffic will be legitimate customers trying to purchase products through authorized AI agents.

The distinction therefore becomes:

Malicious automation vs. authorized automation.

Transaction systems may need additional context such as agent identity, authorization scope, purchase intent, and transaction history.

This information could also become valuable when handling refunds and disputes.

If an agent purchased something incorrectly, merchants need to understand what the customer authorized, what the agent actually did, and which controls were applied.

What This Means for Shopify, WooCommerce and Medusa

You don't necessarily need to rebuild your e-commerce platform for agentic commerce.

Instead, audit the infrastructure you already have.

Shopify

Evaluate whether your products, inventory, carts, orders, and checkout capabilities can be accessed securely through APIs and integrations rather than relying entirely on browser automation.

WooCommerce

WooCommerce already provides APIs, but merchants should carefully control which operations external agents can access. An agent should never receive unnecessary WordPress or administrative privileges.

Medusa

Headless commerce platforms such as Medusa are particularly interesting because commerce functionality is already separated from the storefront.

That makes it possible to create an architecture such as:

AI Agent → Agent Gateway → Commerce API → Products / Cart / Inventory → Payment Provider → Order

The Agent Gateway can authenticate the agent, validate permissions, enforce spending limits, and log transactions before requests reach the core commerce system.

A Practical Agentic-Commerce Roadmap

E-commerce businesses don't need to implement autonomous purchasing overnight.

A practical roadmap is:

Phase 1 — Make your data AI-ready

Ensure products, pricing, inventory, variants, shipping, and policies are structured and accessible through APIs.

Phase 2 — Expose commerce capabilities

Provide secure APIs for product discovery, carts, inventory, shipping, and orders.

Phase 3 — Add agent authentication

Introduce mechanisms to identify and authorize external AI agents.

Phase 4 — Secure payments

Evaluate tokenized payment credentials and emerging agentic-payment infrastructure.

Phase 5 — Enforce policies

Implement spending limits, merchant restrictions, approval requirements, and transaction logging.

Phase 6 — Enable autonomous checkout

Only after these foundations are reliable should an agent be allowed to independently complete purchases.

Is Your Store Ready for Agentic Commerce?

Ask your engineering team:

• Can an AI agent access our product catalog without scraping our website?
• Can it check real-time inventory and pricing?
• Can it create and modify a cart through an API?
• Can we authenticate and identify agents?
• Can we restrict what an agent is allowed to purchase?
• Are payment credentials tokenized?
• Can we audit agent-initiated transactions?
• Can we revoke an agent's access?
• Can our fraud systems distinguish legitimate automation from malicious bots?

If several answers are "no", your biggest challenge may not be AI.

It may be your underlying commerce architecture.

The Future Is More Than an AI Chatbot

Agentic commerce is moving the role of AI from helping customers shop toward acting on their behalf.

That requires more than an LLM. It requires APIs, identity, authorization, payment infrastructure, security, fraud prevention, and reliable commerce systems working together.

For e-commerce businesses, the opportunity is to prepare the infrastructure now rather than waiting until AI agents become a mainstream purchasing channel.

At Webloom Labs, we help businesses build modern commerce systems across Shopify, WooCommerce, Medusa, custom platforms, payment integrations, AI agents, and workflow automation.

Want to know whether your commerce platform is ready?

Agentic Commerce Readiness & Payment Architecture Audit

We can assess your current architecture, identify the gaps, and define a practical roadmap for agent-ready commerce.