OpenAI/Stripe ACP Delegated Payment Spec

A dated reading of what is claimed, reported, and independently verified in the current evidence.

Current reading

Readiness band and full integer triple

AI-assisted assembly · derived results

Readiness band

Emerging

Primary summary from verified readiness

Evidence strength Growing

Decision

Agent-assisted assessment · independently reviewed · 2026-10-02

Consider a limited pilot with a compatible PSP, conditional on transaction-level security testing.

Why: Implementations exist, but allowance binding and replay behavior need deployment-level confirmation. Original checkout field results also showed commercial limitations.
Next: Pin the API version and test merchant/session binding, amount and currency limits, expiry, single use, request integrity, retries and payment-to-order recovery before expanding.

Constraints

Direct integration requires a PSP or a PCI DSS Level 1 merchant with its own vault.
The released delegation endpoint supports only card credentials.
Checkout-session binding at payment time needs explicit PSP enforcement.
Optional signatures and timestamps require deployment-specific integrity and freshness controls.
Public validation of current-version token limits and replay handling remains limited.
Checkout flexibility and conversion need testing in the intended buying journey.

Evidence summary

AI-assisted assembly

Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.

Publication record

Revision 4