ChatGPT Wallet lets an AI agent pay a website without ever seeing the user’s card number: the payment network issues a stand-in token, and the user approves every purchase with a security check such as Face ID or a fingerprint scan. OpenAI built it with American Express, Mastercard and Visa, it said on 13 November, and it starts in dots for ChatGPT Pro subscribers in the US.
This explainer walks through how an agent wallet pays, step by step, and compares it with what Visa, Mastercard, American Express, Google and Meta have published about their own agent payment products. Our table of the six, built from each company’s own page, is below; our news piece on the launch is here.
Business Pill · Agentic Commerce Explained
An evergreen Business Engineer explainer on what changes when the shopper is an agent. It teaches the concept only and does not discuss ChatGPT Wallet.
The key insight: As we read the six pages, the common design is a token in place of the card number plus a human approval step; the products differ mainly in where that approval sits, from a security check on every ChatGPT Wallet purchase to Amex’s captured purchase intent.
An agent wallet is a stored payment method that a software agent can use on a person’s behalf, under rules the person sets. OpenAI describes ChatGPT Wallet as “the first wallet that lets agents pay without access to users’ actual card details and that requires a security check for every purchase”.
The core part is a network token. Visa’s April 2025 launch of Visa Intelligent Commerce described “tokenized digital credentials” that “confirm that a consumer’s chosen agent is allowed to act on a consumer’s behalf”. Mastercard’s Agent Pay, launched the day before, introduced “Mastercard Agentic Tokens”, built on the tokenization behind mobile contactless payments and card-on-file.
The difference from an ordinary saved card is who holds the real number. With ChatGPT Wallet, OpenAI says, the card is charged “without ChatGPT Wallet sharing their actual card details with the business or agent”. Our lesson on agentic commerce covers the wider shift.
Six agent payment products compared from each company’s own page as of 13 November 2026: how the agent pays, the approval step and who can use it. ChatGPT Wallet uses a network payment token and a security check, such as Face ID or a fingerprint, on every purchase; Google’s help page says Gemini cannot make transactions with Google Wallet. Summary by FourWeekMBA.
How a ChatGPT Wallet Purchase Works, Step by Step
OpenAI’s page describes the flow, which we break into four steps. First, the user adds a card once. Second, before each purchase, “the user reviews the items, total, and selected card, then approves it with a security check such as Face ID or a fingerprint scan”.
Third, “the payment network provides a payment token”, which OpenAI calls “a substitute for the user’s actual card details”, with its own card number, security code and expiration date. Fourth, the agent checks out with that token on the merchant’s site, and the charge lands on the selected card.
Each approval, OpenAI says, “creates a clear record of the purchase the user authorized the agent to make”. The user buys directly from the business, which keeps “control over pricing, fulfillment, returns, and customer service”.
Visa’s developer documentation shows the same pattern from the network side. An agent platform enrols the card, gets back a “provisioned agentic token” and does not store the raw card number; the platform then sets up a Visa Payment Passkey bound to the cardholder’s device, unless Visa has approved its use case to run without one. Only after that can the platform request credentials for a purchase.
Partners named on each company’s own launch page, counted by FourWeekMBA; Visa’s and Mastercard’s are from April 2025 and only companies named are counted, not ‘and more’. Sierra’s 100+ is Sierra’s own figure.
Who Else Is Building One
Mastercard says Agent Pay “will require trusted AI agents to be registered and verified” before they can pay, and that consumers will have “complete control over what the agent is allowed to purchase on their behalf”. Its April 2025 release named Microsoft, IBM, Braintree and Checkout.com as partners.
American Express announced its Agentic Commerce Experiences (ACE) Developer Kit with five services: Agent Registration, Account Enablement, Intent Intelligence, Payment Credentials and Cart Context. The release marks two of the five, Agent Registration and Cart Context, as “Services in development”, and says the kit will go to “select developers”.
Google’s Gemini can connect to Google Wallet, but its help page says Gemini Apps “can’t perform certain actions” with it, starting with: “Make transactions using payment methods in your Google Wallet”. The connection is for insights, budgeting tips and passes, for users who are 18 or over and in the US.
Meta’s Muse is an agent, not a wallet, but its Chrome listing says it can “actually buy on your behalf, with your OK” and that users “Approve actions before they happen”. Sierra said on 13 November that Poppy, its protocol for personal agents, “is now on for everyone who uses Muse”; our piece on Muse in Chrome and our piece on Poppy 1.0 cover both.
Who Pays When Something Goes Wrong
OpenAI says users keep their card’s “existing rewards and protections for eligible disputes with businesses, for example when an item is defective”, and that “Banks and networks bring their expertise to evaluating transactions”. In the text we read, OpenAI does not describe a separate protection for agent errors.
American Express goes further on paper. It announced Amex Agent Purchase Protection and says that “In the future, if a Card Member authorizes an AI agent to make a purchase and that agent sends American Express the customer’s authenticated purchase intent, American Express will protect eligible customers from charges related to AI agent error”. A footnote says terms and conditions will apply.
Visa’s 2025 release says commerce signals are shared with Visa in real time, “enabling Visa to effect transaction controls and help to manage disputes”. Mastercard’s describes “a process to help clarify agentic transactions that may be unfamiliar or unrecognized”.
What Merchants Have to Do
OpenAI’s Commerce Partner Playbook lists four areas. Businesses can claim their listing in ChatGPT and upload a product feed, and make sure ChatGPT agents can reach the website. They can also work with payment and risk providers on agent purchases, and give agents more ways in, such as a plugin or WebMCP tools. Our piece on who owns product data for shopping agents covers the feed side.
On access, OpenAI asks sites to configure their CDN or firewall “to recognize signed requests using Web Bot Auth”. Its developer docs say Akamai, Cloudflare, HUMAN and Vercel “verify ChatGPT request signatures automatically”.
On risk, OpenAI warns that “risk systems may still flag legitimate purchases made by agents, leading to declines or cancellations”. It names fraud prevention partners Forter, Riskified, Sardine and Signifyd, and payment service providers Adyen, Checkout.com and Stripe. Our piece on Forter’s agent order data looks at how stores treat agent orders today.
What to Watch
OpenAI says that “Over time, we expect users to be able to delegate purchases entirely to their agent” by setting “clear parameters” such as spending limits, purchase categories or time periods. OpenAI says those purchases would be pre-approved “with enhanced safeguards that build on today’s protections, including biometric checks and clear records of authorization”. It is starting with ChatGPT Pro users, it says, to learn from real-world use with businesses, banks and payment networks.
By our count, OpenAI’s page names 10 partners: three card networks, four fraud firms and three payment providers. Visa’s 2025 release named eight partners, including OpenAI, plus “and more”; Mastercard’s named four; Sierra says Poppy has more than 100 design partners. Amex’s release names none.
The Structural Read
As we read OpenAI’s page, the merchant side changes least: the token runs through existing checkout flows, while the work falls on firewalls and fraud filters that may treat an agent as a bot.
As we read the Amex release, it is the only one of the pages that describes a protection specifically for agent errors, and it ties that protection to the agent sending the authenticated purchase intent.
OpenAI, Introducing ChatGPT Wallet, 13 November 2026
“We’re building agent-led commerce to fit reliably into existing systems.”
Three Implications
FOR MERCHANTS OpenAI asks sites to recognise signed requests using Web Bot Auth and to work with their payment and risk providers so legitimate agent purchases are not declined.
FOR CARD ISSUERS Visa’s developer docs require a provisioned agentic token and, unless approved otherwise, a device-bound Visa Payment Passkey before an agent can request credentials for a purchase.
FOR SHOPPERS OpenAI says users keep their card’s existing rewards and protections for eligible disputes, and approve each purchase after reviewing the items, total and card.
The framework states: “The surface, not the model, governs autonomy.”
As we read it, a wallet’s approval step is that surface at the point of payment: how much the agent may spend without asking is set by the product, not by the model. The framework does not discuss ChatGPT Wallet.
What Is Not Established
OpenAI’s page does not give fees, the number of merchants that accept ChatGPT Wallet today, or a date for wider availability. The Amex protection is described for the future and its terms were not published in the release we read. The Muse listing does not say how Muse pays.
Google’s help page carries no date on the page; the Internet Archive’s first capture of it is from 5 October 2026. The partner counts in our chart are our tally of names on each page and are not the companies’ own totals, except Sierra’s.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
An agent wallet separates the agent from the card number: the network issues a token, the user approves, and the merchant charges the token through its existing checkout. ChatGPT Wallet adds a security check, such as Face ID or a fingerprint, on every purchase and launches with Amex, Mastercard and Visa for US Pro users. Visa, Mastercard and Amex have each published their own agent token programmes, Amex with an announced protection for agent errors, while Google’s Gemini says it cannot pay with Google Wallet.
95,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.
A note on sourcing. We read OpenAI’s ChatGPT Wallet announcement and its developer page on agent access, Visa’s April 2025 Visa Intelligent Commerce release and developer documentation, Mastercard’s April 2025 Agent Pay release and product page, American Express’s ACE Developer Kit release, Google’s Gemini help page on Google Wallet, Sierra’s Poppy 1.0 post and Meta’s Muse listing on the Chrome Web Store, all on 13 November 2026.
The comparison table and partner counts are our own summary and tally of those pages. We did not contact the companies for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
