ap2-payment-processor

AP2 Merchant Payment Processor Implementation

Before writing code

Fetch live docs:

1. Fetch https://ap2-protocol.org/specification/ for Payment Processor responsibilities
2. Web-search site:github.com google-agentic-commerce AP2 samples roles merchant_payment_processor for reference implementation
3. Web-search site:github.com google-agentic-commerce AP2 payment processor authorization for authorization flow
4. Fetch https://ap2-protocol.org/topics/core-concepts/ for MPP role details

Conceptual Architecture

What the Payment Processor Does

The Merchant Payment Processor (MPP) handles the financial side of the transaction on behalf of the merchant:

1. Receives payment requests from the Merchant Agent
2. Requests credentials from the Credentials Provider using the Payment Mandate
3. Constructs authorization messages for the payment network
4. Processes the payment through the network/issuer
5. Handles challenges (3DS2, OTP) when required
6. Returns receipts to the Merchant Agent

Where It Sits in the Flow

Shopping Agent → Merchant Agent → MPP → Credentials Provider
                                  ↓
                            Payment Network / Issuer
                                  ↓
                            Authorization Result
                                  ↓
                     MPP → Merchant Agent → Shopping Agent → User

Key Responsibilities

Payment Authorization

• Receive the Payment Mandate from the Merchant Agent
• Present the mandate to the Credentials Provider
• Receive tokenized/resolved credentials
• Construct network authorization message
• Submit to the payment network for authorization
• Handle authorization response (approved, declined, challenged)

Challenge Handling

When the network/issuer requires additional verification:

• 3DS2 — Strong customer authentication challenge
• OTP — One-time password verification
• The MPP triggers a redirect to a trusted user surface
• User completes the challenge
• MPP retries authorization with challenge response
• V0.1 supports redirect challenges