Cloudflare said it is collaborating with Visa, Mastercard, and American Express to build an authentication layer for what it calls agentic commerce, a model in which AI software agents can shop and complete payments on behalf of consumers. The initiative is designed to help merchants identify trusted automated traffic while filtering out malicious bots, a challenge that is becoming more urgent as AI systems move from recommendation tools into transactional roles.
A new security layer for agentic commerce
At the center of the effort is Web Bot Auth, a protocol Cloudflare says allows AI bots and agents to authenticate their identity and intent. In practical terms, the protocol is meant to give merchants a way to distinguish between legitimate AI agents acting for real users and bad actors attempting fraud, abuse, or unauthorized automation.
Cloudflare framed the project as foundational infrastructure for a future in which autonomous software does more than browse products. In this model, an AI agent could move through the full commerce journey, from product discovery and selection to checkout and payment, while the merchant still retains visibility into whether that traffic should be trusted.
How Visa, Mastercard, and Amex are participating
According to Cloudflare, Visa is co-developing a new Trusted Agent Protocol that will integrate Web Bot Auth into Visa Intelligent Commerce. Mastercard plans to incorporate Web Bot Auth into Mastercard Agent Pay, while American Express will apply the protocol within its own agentic commerce efforts. Together, these integrations suggest that major payment networks are preparing for a future in which AI agents may increasingly be involved in the act of transacting, not just assisting.
Cloudflare also said that AI agents built with the Cloudflare Agents SDK will be able to use these protocols to transact autonomously. For merchants, the value proposition is twofold: better identification of trusted agent traffic and the ability to accept a wider range of payment methods without losing control over fraud screening and user trust.
Payments support could extend to crypto
One notable detail in Cloudflare’s announcement is that merchants using the framework may be able to accept multiple payment types, including credit, debit, and crypto. While the company did not provide implementation timelines or transaction volume expectations, the inclusion of cryptocurrency in the supported payment mix is significant. It suggests that agentic commerce is being conceived as a broad payments infrastructure layer rather than one limited to traditional card rails.
For the digital asset industry, that detail matters because it places crypto alongside mainstream consumer payment methods in a next-generation checkout architecture. If agent authentication becomes standardized, crypto could potentially become one of several payment options available to verified AI agents operating under defined permissions.
Why trust is emerging as the central issue
Cloudflare Chief Strategy Officer Stephanie Cohen said the future of commerce is agentic and argued that the company is building a trusted base layer for it. Her comments emphasized a recurring theme across the announcement: security should not be bolted on after the fact, but engineered into the system from the beginning.
That framing was echoed by the participating payment companies. Visa’s Chief Product and Strategy Officer Jack Forestell said the rise of AI agents acting on behalf of consumers is ushering in a new era of commerce that requires trust, transparency, security, and industry collaboration. He added that merchants should not be forced to choose between aggressively blocking bots and serving genuine customers, positioning the Trusted Agent Protocol as an attempt to solve that tension.
Mastercard Chief Product Officer Jorn Lambert took a similar position, arguing that agents could make shopping far more seamless, but only if the agent itself can be trusted and merchants have tools that make support straightforward. In his view, collaboration on agent verification is necessary if agentic commerce is to become scalable, secure, and widely adopted.
American Express Executive Vice President and Head of Global Innovation Luke Gebb said the company is using Web Bot Auth to help merchants identify trusted agents and deliver secure experiences. He described trust and accountability as core principles behind the company’s approach to digital interactions.
A wider ecosystem is already giving feedback
Beyond the three card networks, Cloudflare listed a broader set of companies that are providing feedback on Web Bot Auth for agentic commerce. That group includes Adyen, Checkout.com, Circle, Fiserv, Microsoft, Nuvei, Shopify, Webflow, and Worldpay. The range of participants is notable because it spans payment processors, financial infrastructure providers, enterprise technology firms, and e-commerce platforms.
This broader participation suggests that agentic commerce is not being treated as a narrow card-network upgrade. Instead, the emerging stack appears to involve multiple layers of internet infrastructure, merchant tooling, payment processing, and digital identity. That matters because widespread adoption will likely depend on interoperability rather than proprietary systems operating in isolation.
Cloudflare’s broader push into agent-to-merchant infrastructure
Cloudflare also referenced several adjacent initiatives that it says are intended to accelerate agent-to-merchant connectivity. These include contributions to open efforts such as the Agent Payments Protocol, the introduction of the Cloudflare NET Dollar, and the formation of the x402Foundation with Coinbase. While the company did not go into operational detail in this announcement, the mention of these projects indicates that its ambitions extend beyond bot verification into a wider transactional framework for autonomous software.
For crypto observers, the Coinbase-linked x402Foundation and the mention of Circle in the feedback group reinforce the idea that blockchain-based payment infrastructure could have a role in future agent-driven transactions. Even so, the immediate focus of the announcement remains identity, trust, and merchant-side verification rather than settlement mechanics.
What the announcement means for merchants and the crypto sector
The rise of AI agents in commerce creates a difficult balancing act. Merchants need to reduce fraud, scraping, and abuse, but they also do not want to block useful automation that could improve conversion and customer experience. If AI agents become common shopping intermediaries, the checkout page may need to recognize not only human customers but also software acting under human authorization.
That is where Cloudflare and its partners are trying to define the rules. By creating authentication standards for bots and agents, they are attempting to establish a system in which merchants can decide which automated actors to trust, which payment methods to permit, and how to maintain accountability when software starts initiating transactions.
For the crypto industry, the development is worth watching because it places digital assets inside an emerging conversation about machine-to-merchant payments. While this announcement does not promise mass crypto adoption by AI agents, it does indicate that crypto is being considered part of the payment mix in future autonomous commerce environments.
Ultimately, the announcement marks another step in the evolution of AI from assistant to actor. The next phase is not simply about whether AI can recommend products or draft shopping lists. It is about whether AI can be authenticated, trusted, and authorized to complete purchases in real commercial settings. Cloudflare, Visa, Mastercard, and American Express are now trying to build the security framework that would make that possible.