AP2 and agent payments: how an agent proves it's allowed to spend on someone's behalf.
A credential proves an AI agent is who it says it is. AP2 (Agent Payments Protocol) proves something narrower and more specific: that a real person authorised this exact spend, up to this exact limit, and a business can verify that before it charges anything.
6 min read
The gap a credential alone doesn't close
Knowing an agent is real answers one question. Knowing it's allowed to spend this much, right now, answers a different one entirely.
An agent can be genuinely who it claims to be and still not have a specific spend approved. Identity answers "is this a real, trusted agent." It doesn't answer "did anyone agree it could spend £85 on this order, today." Those are different questions, and a business that only checks the first one is trusting the second on faith.
What a mandate is
AP2's core object is a mandate: a signed statement from the person the agent is acting for, saying this agent may spend up to this amount, on this kind of thing, by this date. It's cryptographically verifiable, so a business can confirm it was genuinely issued rather than claimed after the fact, and it can be scoped as tightly as a single transaction or as loosely as a standing weekly budget.
What a business sees at checkout
Alongside the order itself, a mandate reference arrives that the business's system checks before completing anything: does this mandate cover this amount, is it still valid, has it already been used if it was meant to be single-use. Only once that clears does the transaction proceed.
Proof the payment was authorised before it happened.
AP2 isn't a new way to pay. It's proof the payment was approved before it happened, rather than something a business has to establish after the fact through a chargeback or a phone call. That's the real value: fewer disputes, because the authorisation was checkable at the moment it mattered.
Where the mandate gets checked
Selfe verifies the mandate as part of every checkout it processes, so a business never completes a transaction on an agent's word alone. If the mandate doesn't cover the spend, the transaction simply doesn't go through.
Can a mandate cover more than one purchase?
Yes. It can be scoped to a single transaction or to a standing limit over time, depending on what the person authorised.
What happens if the mandate doesn't cover the amount?
The transaction is refused before it completes, the same as a declined card, rather than going through and being disputed later.
The plumbing behind every agent purchase.
Every purchase an AI agent completes, whatever it's buying, passes through the same four jobs: proving who the agent is, proving what it's allowed to spend, connecting to the business's own systems, and completing a transaction the business can settle. The protocols in this hub each do one of those jobs. None of them does all four.
Agent credentials: the token that says "yes, actually let this agent buy."
Before an AI agent can act on anyone's behalf, something has to vouch for it. An agent credential is the short-lived, scoped proof a business checks before it trusts a request enough to act on it.
Holds, mandates and spend limits: how a business keeps control of an automated payment.
A mandate only says what an AI agent was allowed to try. What protects a business is what happens on its own side of the transaction: the hold it places, the ceiling it enforces, and the mandate scope it insists on before a booking or order is allowed to proceed.