Cloudflare announced it is working with Visa, Mastercard, and American Express to build an authentication layer for “agentic commerce,” aiming to enable autonomous software agents to shop and pay at millions of merchants while blocking malicious bots.
A Unified Protocol for AI Agent Commerce
The collaboration centers around Web Bot Auth, a protocol that allows AI bots and agents to authenticate themselves. Visa is co-developing a new Trusted Agent Protocol that integrates Web Bot Auth into Visa Intelligent Commerce. Mastercard will incorporate Web Bot Auth into Mastercard Agent Pay, and American Express will leverage the protocol for its own agentic commerce program, Cloudflare said.
AI agents built with the Cloudflare Agents SDK will be able to use these protocols to transact autonomously, helping merchants identify trusted agent traffic and accept a range of payment methods, including credit, debit, and crypto.
“The future of commerce is agentic, and Cloudflare is building the trusted foundation for it,” said Stephanie Cohen, Cloudflare’s chief strategy officer. “We’re directly enabling developers, merchants, and payments companies to innovate, and that starts by ensuring security is not an afterthought—it’s built in by design.”
Industry Leaders Emphasize Trust and Collaboration
Visa framed the effort as a way to balance fraud controls with customer experience. “As AI agents begin to transact on behalf of consumers, a new era of commerce is emerging—one that demands trust, transparency, security, and industry collaboration,” said Jack Forestell, chief product and strategy officer at Visa. “Merchants shouldn’t have to choose between blocking bots and serving real customers—Trusted Agent Protocol helps solve that.”
Mastercard insisted that verifying agent identity is key to adoption. “Agents have the potential to enable a much more seamless shopping experience, but this will only be possible if the agent can be trusted and if merchants have the tools they need to easily support this new era of commerce,” said Jorn Lambert, chief product officer at Mastercard. “In collaboration with industry players like Cloudflare, we are simplifying agent verification for merchants and ensuring a unified approach to agentic commerce that is scalable, secure, and widely adopted.”
American Express noted that it will apply Web Bot Auth to help merchants identify trusted agents. “American Express is excited to utilize Cloudflare’s Web Bot Auth Protocol to help merchants identify trusted agents and deliver secure agentic commerce experiences,” said Luke Gebb, executive vice president and head of global innovation at American Express. “Trust and accountability are at the core of what we do, and this collaboration continues our commitment to ensuring safety and confidence in every digital interaction.”
Ecosystem Partners and Open Standards
Cloudflare said additional partners providing feedback on Web Bot Auth for agentic commerce include Adyen, Checkout.com, Circle, Fiserv, Microsoft, Nuvei, Shopify, Webflow, and Worldpay. The company also cited contributions to open efforts such as the Agent Payments Protocol, the introduction of the Cloudflare NET Dollar, and the formation of the x402Foundation with Coinbase, which it said are intended to accelerate agent-to-merchant connectivity.