Securing agentic commerce: helping AI Agents transact with Visa and Mastercard

The article, published on 24 October 2025, explains that Cloudflare is partnering with Visa and Mastercard to secure automated commerce as AI agents search, compare, and purchase on behalf of consumers. According to Visa and Mastercard, Visa developed the Trusted Agent Protocol and Mastercard developed Agent Pay to help merchants distinguish legitimate agents from malicious bots, with both protocols leveraging Web Bot Auth as the agent authentication layer.

The goal is to enable merchants to identify registered agents, decide whether an interaction is for browsing or paying, and determine how a payment should be processed, all while Cloudflare acts as the validator. The piece also outlines how HTTP Message Signatures and nonce-based replay protection support these protocols, and notes that Cloudflare will host directories for Visa-registered and Mastercard-registered agents to fetch signing keys.

It highlights that Cloudflare’s Agent SDK now supports x402 transactions and will incorporate Visa and Mastercard protocols into the SDK, enabling developers to manage private keys and generate the correct signatures for browsing or purchasing. The article also mentions upcoming managed rulesets to simplify allowing trusted agents on merchant sites and references ongoing efforts with American Express to adopt Web Bot Auth as a foundation.