AP2 Protocol Security: Securing API Checkout Tunnels Against Bot Fraud

Safely handle autonomous checkouts. Learn how to verify AP2 transaction consent tokens and secure your API checkout tunnels.

Accepting automated checkouts introduces new security requirements. You must ensure that requests targeting /api/webmcp/checkout are authentic and did not bypass user consent.

The AP2 protocol addresses this by wrapping payment approvals in cryptographically signed consent tokens. The merchant parses this signature and validates it against the issuer's key to prevent fraud.

For complete technical steps on securing your checkout endpoints, read the AI Commerce specs.