Own the Tokens, Own the Agentic Commerce Customer

AI-referred traffic to US retail sites grew 393% year over year in the first quarter of 2026, and autonomous agents drove more than $22 billion in global online sales during the 2025 holiday season^{1, 2}. That volume already runs through network tokens, and whoever controls the vault holding them controls whether an agent's purchase completes. Own that vault, and every protocol and processor decision that follows gets easier.

By May 2026, AI-referred traffic to retail sites was up 1,324% against October 2024, when Adobe started tracking it³. Most vault architectures were never built to route any of it, in what's becoming a machine-mediated "decide-to-pay" economy rather than a human-driven click-to-pay one⁴.

The lock-in problem is already measured.

93% of companies lack full control over their payment tokens and credentials, and only 7% report complete control⁵.

The same study found 72% of companies need significant or full reintegration work just to add one new payment method. If adding one payment method already costs that much engineering time, adding a new agent commerce protocol next year costs the same, right as agent-initiated volume starts to scale. A portable vault fixes this before it turns urgent.

A processor-owned vault turns a decline into a lost sale.

A human shopper who hits a decline tries a second card or comes back later. An AI agent evaluates merchants as a rational, highly optimized buyer would, on execution, price, and inventory data alone, and it abandons a failed attempt for a competitor instantly⁶.

If the vault holding that agent's stored credential sits inside one processor, a localized outage or a rigid fraud rule ends the transaction with no failover. Merchant-controlled routing turns that same decline into a retry on a second gateway before the agent, or the customer, ever notices.

The exposure is growing every quarter. Stored-credential transactions now make up 40% of Spreedly's platform volume, up from 34% in 2022⁷. More volume running through stored credentials means more revenue riding on whoever controls the vault underneath them.

Network tokens already outperform raw card numbers, before any agent touches them.

A network token is a merchant-specific, sixteen-digit substitute for a card's real number, issued and maintained directly by Visa or Mastercard instead of the merchant or processor. Payment network tokenization ties that token to a specific device and merchant, and updates it automatically when the card expires or reissues. Each transaction runs on a one-time cryptogram instead of the static number.

Visa reports a 4.6% authorization-rate improvement on tokenized card-not-present transactions against the PAN, along with roughly 30% less online fraud⁸. Mastercard reports a 10.3 percentage point approval-rate increase for Checkout.com merchants using network tokens⁹.

Having a token provisioned is not the same as controlling it. The token lives at the network level, but the ability to route a transaction against it across providers depends on who holds the vault underneath. A merchant can have Visa and Mastercard tokens fully provisioned and still have no routing control, if that vault sits inside a single processor.

Standard tokens still assume a human is present. Agents need a token built for delegated authority.

Network tokens were designed around a present human: a biometric scan, a PIN, or a 3D Secure step-up check¹⁰. Agentic commerce runs on a human-not-present model instead¹¹. An AI agent executes a purchase under delegated authority, often long after the person who authorized it has logged off¹².

The fix is a network token enriched with three scheme-validated cryptographic layers, described by Patronusec as an Agentic Token:

• Agent Identity Binding: a cryptographic signature that binds the token to a specific, registered AI agent.
• Merchant Scope Restriction: rules built into the token that restrict its use to designated merchants or product categories.
• Cardholder Consent Reference: a link to an unalterable digital mandate that sets spending caps, transaction frequency, and expiration¹³.

A rogue script that tries to spend outside those limits gets rejected at the card network, before the transaction ever reaches the merchant's gateway or the issuer¹⁴.

The industry is standardizing how agents prove that authority.

Visa's Trusted Agent Protocol enforces a Know Your Agent framework: a registered AI agent signs its HTTP requests with open cryptographic standards, so merchants and networks can verify the traffic came from a legitimate agent operator and block bot attacks at the perimeter¹³.

Google's Agent to Payment protocol, AP2, uses signed Intent Mandates (what the customer authorized) and Cart Mandates (what the merchant proposed). Because the mandates use open web standards, AP2 works across card rails, real-time ACH, and stablecoin ledgers alike¹⁵.

At the checkout layer, two approaches are emerging, as Checkout.com¹⁶ frames it. OpenAI's Agentic Commerce Protocol optimizes for native checkout inside conversational interfaces like ChatGPT, using Shared Payment Tokens to pass payment data without exposing credentials¹⁷.

The Universal Commerce Protocol, built by Google and Shopify, takes an open, merchant-first approach: merchants publish a machine-readable capability manifest agents can query for catalog, tax, and loyalty data, while the merchant stays the merchant of record^18.

None of those protocols answer where the money actually went.

A payment protocol proves an agent was allowed to spend. It doen’t track what an entire agent fleet actually spent, or confirm that a settled transaction matches its original mandate¹².

The cost of skipping that layer is already documented. On August 11, 2020, Citibank sent $900 million to Revlon's lenders by mistake, because its systems had no ledger control layer separating payment authorization from ledger posting¹⁹.

A production-grade agentic payment system needs three ledger primitives to prevent that kind of error at scale:

• Ledger-enforced budgets: the agent's spend limit lives as a funded account balance in a double-entry ledger, not a counter in application code.
• Idempotency keys: every payment instruction carries a unique key, so a retried request produces one posting instead of a duplicate charge.
• Every settled payment carries the agent, task, and mandate that authorized it, enabling real-time reconciliation and audit¹².

What this means for your agentic commerce efforts

Token ownership is the decision that has to come before any protocol or platform choice. A merchant that owns its vault can add support for TAP, AP2, ACP, or UCP the way it adds a new gateway: as an integration, not a re-platforming project. A merchant that doesn't will refight the same lock-in fight every time a new protocol ships.

Spreedly separates the two problems on purpose. Vault²⁰ gives merchants a processor-independent store for payment credentials, so the token belongs to the merchant rather than to one processor. Connect²¹ handles routing across gateways on top of that ownership, so the protocol and provider decision stays swappable instead of permanent.

Four checks are worth running in the next two quarters, before the 2027 roadmap gets locked:

• Audit who technically owns the stored credentials the business runs on today, not who the team assumes owns them.
• Price out, in engineering hours, what switching processors would cost if it became necessary.
• Confirm the current vault supports token portability without forcing customers to re-enter card details.
• Map which agent commerce protocols the platform will need to support for 2027, before the roadmap gets written around a vault that can't support them.

The counterargument

The strongest objection: agent-initiated volume is still a small share of total commerce, and the winning coordination protocol hasn't been decided yet. Both are true today. Neither changes the fact that a portable vault works underneath whichever protocol wins, while a processor-locked vault has to be rebuilt no matter which one does, especially as AI agents increasingly evaluate merchants purely on structured, machine-readable data rather than brand or habit²².

The test to run before that roadmap gets locked: try to fail over a stored-credential transaction to a second gateway without asking a customer, or an agent, to re-enter a card. If that fails today, the vault is this quarter's audit item, not the protocol.

References

1. _{Adobe, "AI Traffic Surge to Retail Sites," April 2026}
2. _{World Economic Forum, "AI Agents and Trust"}
3. _{Digital Commerce 360, "Adobe: AI-referred traffic to retail sites doubles in a year," June 2026}
4. _{Airwallex, "Agentic Payments"}
5. _{PYMNTS Intelligence and Spreedly, "The Orchestration Advantage," June 2026}
6. _{SiliconAngle, "Agentic Opportunity: OpenAI and Stripe Build Rising Tide," April 2026}
7. _{Spreedly, "Spreedly Launches Standalone Payment Vault," July 2026}
8. _{Visa Commercial Solutions, VisaNet data, June 2025}
9. _{Mastercard Network Tokenization, Checkout.com FY2025 data}
10. _{Medium, "When the Cardholder is an AI: The Authentication Problem," Tori Joels}
11. _{NMI, "Human-Not-Present: Agentic Commerce"}
12. _{Formance, "What are Agentic Payments"}
13. _{Patronusec, "Network Tokens vs. Agentic Tokens"}
14. _{Eco, "Mastercard Agent Pay documentation," 2026}
15. _{Fintech Brainfood, "AP2 Explained"}
16. _{Checkout.com, "Agentic Commerce Questions Answered"}
17. _{Stripe, "Supporting Additional Payment Methods for Agentic Commerce"}
18. _{Fintech Brainfood, "AI Checkout"}
19. _{Formance, Citibank/Revlon Case Analysis}
20. _{Spreedly Vault Product Page}
21. _{Spreedly Connect Product Page}
22. _{Monocle, "Agentic Commerce Trends for Shopify Merchants"}