ap2-credentials-provider

AP2 Credentials Provider Implementation

Before writing code

Fetch live docs:

1. Fetch https://ap2-protocol.org/specification/ for Credentials Provider responsibilities
2. Web-search site:github.com google-agentic-commerce AP2 samples roles credentials_provider for reference implementation
3. Web-search site:github.com google-agentic-commerce AP2 credentials provider tokenization DPAN for tokenization details
4. Fetch https://ap2-protocol.org/topics/privacy-and-security/ for security requirements

Conceptual Architecture

What the Credentials Provider Does

The Credentials Provider (CP) is the payment credentials custodian — a digital wallet that securely manages payment methods and handles tokenization:

1. Stores payment credentials — User's payment methods (cards, wallets)
2. Provides payment method listings — Returns available methods to Shopping Agent
3. Handles tokenization — Converts real credentials to DPANs (Digitized Primary Account Numbers)
4. Validates Payment Mandates — Verifies user authorization before releasing tokens
5. Facilitates payment — Provides credentials to Merchant Payment Processor
6. Manages user identity — Links user identity to payment methods

Critical Security Role

The Credentials Provider is the only entity that handles raw payment credentials:

• Shopping Agents never see real card numbers
• Merchants receive only tokenized references
• PCI data stays within the CP's security boundary
• This role-based separation is fundamental to AP2's privacy model

Agent Card

The Credentials Provider advertises:

• AP2 extension support
• Available payment method types
• Tokenization capabilities
• Authentication requirements (OAuth2 recommended)
• Endpoint URL (reference: port 8002, path /a2a/credentials_provider)

Key Responsibilities

Payment Method Management

• Store user payment methods securely (PCI DSS compliance)
• Return available payment methods when queried by Shopping Agent
• Include method details sufficient for user selection (last 4 digits, card type, expiry)
• Never expose full card numbers to Shopping Agents