Autonomous agents are no longer just chatting; they are spending real money. A new technical guide published on October 20, 2026, by developer destruti on DEV.to provides a practical blueprint for the Agent Payments Protocol (AP2), detailing exactly how AI systems authenticate financial transactions without human intervention. The core mechanism relies on a cryptographically signed Payment Mandate, a JSON structure that defines the strict boundaries of an agent's spending power before any request is even sent.

The Anatomy of a Payment Mandate

The foundation of AP2 is the Payment Mandate, a JSON object that acts as a digital leash. Before an agent can execute a transaction, the user issues this mandate, which includes a unique mandate_id, the holder's decentralized identifier (DID), and the agent's DID. Crucially, the constraints field locks down the spending cap, the current spent amount, currency, and a specific validity window. The guide highlights a merchant_whitelist array, ensuring agents can only transact with pre-approved domains like api.cloudcompute.io, and a scope_intent string that provides human-readable context for the audit trail.

Execution and Merchant Verification

When an agent encounters a paid resource, it bundles the target operation with the active mandate and signs the entire payload using its own private key. The resulting execution payload includes the original holder signature and a new agent_signature, creating a dual-authentication layer. On the merchant side, the API gateway runs a rigorous validation pipeline. This pseudocode demonstrates a five-step check: verifying the holder's Ed25519 signature, checking the mandate's expiration timestamp, validating the merchant domain against the whitelist, ensuring the requested cost doesn't exceed the remaining spending balance, and finally verifying the agent's signature.

Security Best Practices for Agent Swarms

The article emphasizes that cryptographic verification is only half the battle. To minimize the blast radius of a compromised agent container, developers must rotate agent keys with limited lifespans. Furthermore, the guide warns against allowing agents to dynamically expand their merchant_whitelist without direct human authorization. For compliance, every transaction must be logged in an immutable ledger that maps the mandate_id to actual settlement records, ensuring that when an AI goes rogue, you have the receipts to prove exactly who authorized the spend.

Key Takeaways

  • AP2 uses a JSON-based Payment Mandate with Ed25519 signatures to strictly define spending limits, validity windows, and approved merchants before any transaction occurs.
  • Merchant verification involves a five-step pipeline: validating the holder's signature, checking expiration, verifying the merchant whitelist, ensuring spending caps are not exceeded, and confirming the agent's signature.
  • Security best practices include rotating agent keys to limit blast radius, enforcing strict merchant whitelists, and logging every transaction to an immutable ledger for audit compliance.

The Bottom Line

AP2 proves that trustless AI spending isn't just a buzzword but a viable engineering pattern. By hardcoding cryptographic boundaries into the mandate structure, developers can finally scale autonomous agents without fearing unchecked financial liability.