Commerce Protocols

One registration, one SDK, every agent-commerce protocol — A2A, ACP, AP2, UCP, MPP, x402, VI, Agent Pay, TAP.

The agent commerce ecosystem is fragmenting fast — Google, OpenAI, Stripe, Coinbase, and others each ship their own protocol for how agents communicate, transact, and prove payments. AstraSync absorbs that fragmentation. Agents declare every protocol they support in a single registration flow, get a pre-formatted agent card they can hand out, and use one SDK to actually speak the protocols at runtime. Counterparties read the same card and use the same SDK to decide whether to accept the agent.

AstraSync verifies agent-driven commerce traffic across the major emerging protocols — Mastercard, Visa, Google, OpenAI, Stripe, Shopify, Coinbase. The Verification Gateway adapters extract per-protocol artifacts from the request, verify signatures and chain integrity, and apply endpoint policy in a single call.

Tier 1 vs Tier 2 — the persistence boundary

We split the commerce ecosystem into two tiers based on lifecycle, because they need very different handling:

Persistent (registration-time)

Capabilities the agent declares once and carries forever. Stored on the agent card, surfaced to every counterparty at verify-access time, used to derive PDLSS boundaries automatically. All 10 protocols have persistent metadata.

Commerce: A2A, ACP, AP2, UCP, MPP, x402, ERC-8004. Payment Networks: VI, Agent Pay, TAP.

Session-based (runtime)

Short-lived cryptographic tokens that prove a specific transaction is authorised. They flow through the request pipeline, get verified by the gateway, and disappear. Payment Network protocols (VI, Agent Pay, TAP) have both: a persistent declaration at registration AND session tokens at runtime.

Examples: VI SD-JWT chains, Agent Pay / TAP RFC 9421 signatures, ACP HMAC webhooks, UCP checkout sessions.

Tier 1 declarations answer "what can this agent do, in principle?". Tier 2 tokens answer "is this specific transaction authorised, right now?". Counterparties get both signals through one SDK call. Tier 1 protocols (ACP, UCP, MPP, x402) are persistent-only — the agent declares its identity once via the standing AstraSync registration. Tier 2 protocols (VI, AP2, Agent Pay, TAP) layer session tokens on top of the persistent declaration; AstraSync verifies the session token AND the underlying agent registration on every request.

What AstraSync does for you

Multi-protocol in one registration

Declare A2A + ACP + AP2 + MPP at once via a single checkbox grid. Shared fields (URLs, provider name) are entered once and applied across protocols. Per-protocol fields render in collapsible sections so the form stays manageable. No duplicate registrations, no drift between protocol-specific accounts.

Pre-formatted agent cards

Registration produces a portable JSON agent card that includes every declared protocol's metadata, the verification gateway endpoint, the runtime-challenge capability flag, PDLSS boundaries, and on-chain identity if you've registered one. Hand it out, embed it in your agent.json discovery file, attach it to outbound requests — counterparties parse it the same way every time.

One SDK, every transport

The verification gateway SDK abstracts HTTP, MCP, A2A, and the commerce protocol transports under one credential injection / extraction surface. Your agent calls gateway.fetch(); the SDK picks the right transport, attaches the right headers, handles RFC 9421 signing for Agent Pay / TAP, and parses x402 challenges — without your code knowing the details.

PDLSS pre-populates from declarations

When you declare AP2 with a $500 transaction cap, PDLSS auto-fills the autonomous and hard limit at $500 — your protocol declarations become your permission boundaries with no double entry. Multi-protocol agents get the most restrictive merge across protocols (lowest spend cap wins, jurisdictions union, currencies first-non-default).

For counterparties & merchants

The same verification gateway SDK that agents use is what counterparties use to interpret the declarations. One verify-access call returns:

Declared protocols as an array — you can route an ACP request differently from a UCP request without negotiating capabilities up front.
PDLSS boundaries already merged from every declared protocol — you see the maximum transaction value the agent is authorised for, the jurisdictions it's scoped to, the counterparties it's allowed to transact with.
Runtime trust signals like runtimeChallengeSupported (whether the agent has a verification endpoint mounted), trust score, and KYD status — useful for tier-based acceptance policies.
Recommendation — grant, step_up_required, or deny — and the reasons, so you can either trust the recommendation or apply your own logic on top.

import { CounterpartyClient } from '@astrasyncai/verification-gateway';

const client = new CounterpartyClient({ apiKey: process.env.ASTRASYNC_KEY });
const result = await client.verifyAccess({
  agentId: req.headers['x-astrasync-agent-id'],
  purpose: 'financial_transaction',
  transactionValue: 250,
  currency: 'USD',
});

// result.agent.protocols           → ['a2a', 'acp', 'mpp']
// result.agent.runtimeChallengeSupported → true
// result.pdlss.limits.approvalThreshold  → 500
// result.recommendation             → 'grant'

Supported protocols

Every protocol below is selectable in the registration UI and lands in the agent card as a top-level metadata block. PDLSS pre-population fires automatically based on the fields you fill in. ERC-8004 has its own dedicated section.

Protocol	Vendor	Artifact	AstraSync's role
A2A	Google	Agent-to-agent task / metadata exchange	Cross-vendor agent interop. AstraSync injects ASTRA / ASTRAE identifiers into the A2A metadata block so receivers can verify provenance.
ACP	OpenAI / Stripe	Agentic Commerce Protocol — detached JSON signature	Ed25519 / ES256 signed checkout requests. AstraSync verifies the signature, resolves the agent identity, and applies endpoint policy.
AP2	Google	Agent Payments Protocol — three-mandate SD-JWT chain	Intent → cart → payment SD-JWT chain. Mandate verification + cross-merchant budget enforcement (deferred per §3.3.15).
UCP	Google / Shopify	Universal Commerce Protocol — request envelope	Standardised request shape for agent-driven checkout. AstraSync verifies the agent and forwards the envelope under policy.
MPP	Stripe	Merchant Payment Protocol — request artifact	Stripe-issued payment intent + agent verification handshake. AstraSync sits between the agent and Stripe.
x402	Coinbase	x402 v2 protocol request	HTTP 402 challenge-response payment protocol. Useful for crypto-native agent flows with AstraSync verification.
VI	Mastercard / Google	Verifiable Identifier SD-JWT VC	Persistent identifier credential — proves the agent is registered with a card network. AstraSync verifies the SD-JWT VC and chain.
Agent Pay	Mastercard	RFC 9421 HTTP signature	Mastercard's session-token side. AstraSync verifies the HTTP message signature and resolves the registered agent.
TAP	Visa	RFC 9421 HTTP signature	Visa Trusted Agent Protocol — also signs over RFC 9421. Shares verifier infrastructure with Agent Pay and Web Bot Auth.

JSON schemas

Per-protocol JSON Schemas are generated from the platform's authoritative Zod definitions and shipped at:

https://astrasync.ai/api/docs/schemas/index.json

Per-protocol files (e.g. commerce-acp-request.json, commerce-ap2-mandates.json) sit alongside the index. Re-run npm run generate:schemas in apps/backend to regenerate after schema changes.