Shopify WebMCP Checkout: The Intent/Authorization/Settlement Split, Live in Production
The short answer: on September 28, 2026, Shopify extended WebMCP to checkout. Browser-based AI agents can now read a checkout, update it, and submit the order — after the buyer authorizes it. Shop Pay is included. Zero merchant configuration.
Every outlet covered the announcement. None covered the authorization architecture — which is the real story.
What shipped
Three new checkout tools (per Shopify's Sept 28 developer changelog, via Unite.AI):
-
get_checkout— reads checkout state, messages, post-completion order details -
update_checkout— updates supported checkout fields (address, delivery option, discounts) -
complete_checkout— submits the checkout, only after buyer confirmation -
navigate_to_storefront— returns the tab to the storefront
They run inside checkout-web, share the checkout UI's state, expose no new API, and require no merchant configuration. This builds on native WebMCP activated August 5 across all Liquid storefronts (catalog + cart tools: search_catalog, update_cart, proceed_to_checkout).
The authorization line
The agent can READ, EDIT, and SUBMIT. The agent CANNOT input payment credentials — control hands back to the buyer whenever input is required (3D Secure, blocking UI extensions). The buyer explicitly authorizes the purchase.
That's the intent / authorization / settlement split the six-bank "Building Trust in Agentic Commerce" report (Sept 22) and the GFF regulators (Sept 25) demanded — now shipping as product on a major commerce platform.
The context: Amazon and Adidas are blocking agents from purchasing (TechCrunch, Sept 28 — "and Adidas, apparently!"). Shopify bet the opposite way. Muse and Instinct already have direct Shopify partnerships. The platform war for agentic checkout is on.
Two systems, one protocol
- WebMCP — agents in the buyer's browser (today's news)
- Hosted MCP server — Shopify's server-to-server agent system
- Both use Universal Commerce Protocol (UCP) for discovery, cart, and checkout.
Why this makes the payment gate MORE important, not less
Shopify's "buyer confirms" is the human-confirm band made standard. But buyer confirmation proves WHO agreed — not whether the agreement was wise. That's the $78k Codex lesson, and exactly the gap the per-payment confidence gate fills: the machine-native layer that scores the instruction before it reaches human confirmation.
Live receipts, tested ~20:18 EDT Sept 28 on our gate (decider local-heuristic-v1, calibrated=false):
| Instruction pattern | Score | Band |
|---|---|---|
AI agent calls WebMCP complete_checkout for a $249 digital trading bundle; buyer confirmed the purchase in the checkout session; no payment credentials pass through the agent |
0.18 | ESCALATE — block + log |
AI agent calls WebMCP get_checkout to READ checkout state and display the order summary. No money moves, no order is placed. |
0.16 | ESCALATE — block + log |
The honest finding: the heuristic is conservative by design — it escalates even the read-only pattern, because it keys on agent+checkout+payment instruction language. It scores the instruction text, not the buyer's actual confirmation state — which it cannot see. Shop Pay's buyer confirmation and the confidence gate are complements, not competitors.
The merchant angle nobody covers
It's on by default. Merchants don't install an app, flip a setting, or write code — WebMCP tools were pre-registered on storefronts (Aug 5) and checkout arrives the same way. Any eligible merchant store on the platform is now agent-purchasable out of the box — including ours (ScriptMasterLabs sells 9 high-ticket products on Shopify). Rollout is to "all eligible Shopify merchants" — eligibility terms weren't detailed in the Sept 28 coverage; that's the piece to watch.
Honest costs
- Chromium-only: WebMCP is a Chrome origin trial (Chrome, Edge, Brave). Safari/Firefox out. Google and Microsoft back the standard — the best signal Safari support comes eventually.
- Eligibility fine print: "all eligible merchants" is undefined in the coverage so far.
- Buyer confirmation is a human gate, not a machine gate — the scored-decision layer still needs to exist between the instruction and the confirmation.
- Shopify docs/changelog pages weren't independently opened for this piece — announcement is press-coverage based.
Full dated receipts, claim receipts, and a 5-minute merchant checklist:
Canonical version with live receipts: https://scriptmasterlabs.com/shopify-webmcp-checkout
Top comments (3)
Letting the agent read, edit, and submit checkout while the buyer still enters payment credentials draws a clear line on who agrees to pay.
Buyer confirm answers who said yes. It does not answer what happens when complete_checkout returns silence after the first order may already exist.
After that silence, does your store leave a second submit closed until search finds one order or proves there is none?
Sharp question — it's the exact failure mode the split exists for. In our implementation the authorization decision is recorded before settlement is attempted, so a silent complete_checkout never gets a blind retry: the second submit stays closed until the ledger confirms whether the first order exists or proves there is none. Silence is treated as "unknown, verify first" — never as "failed, retry."
That's the whole point of separating intent/authorization/settlement: the authorization record is the source of truth when the settlement response goes missing. We productized exactly that as SML Commit — an agent posts its intended effect and gets back Allow/Hold/Refuse/Escalate with a public decision URL, bound to the settlement receipt: scriptmasterlabs.com/sml-commit
Yes. Recording the authorization before settlement stops a blind second submit.
Treating silence as unknown, then verify, is solid work.
We pause refund and payout the same way until the first path is clear.
If you want to swap notes on refund paths, DM us.