---
name: ap2-payment-mandate
description: >
  Implement the AP2 Payment Mandate — the VDC shared with payment networks and
  issuers to signal AI involvement and user authorization. Use when building
  payment authorization flows, tokenization, and network integration.
---

# AP2 Payment Mandate

## Before writing code

**Fetch live docs**:
1. Fetch `https://ap2-protocol.org/ap2/specification/` for the Payment Mandate schema
2. Web-search `site:github.com google-agentic-commerce AP2 payment mandate` for type definitions
3. Web-search `site:github.com google-agentic-commerce AP2 src/ap2/types payment` for Python types
4. Fetch `https://ap2-protocol.org/overview/` for Payment Mandate conceptual details

## Conceptual Architecture

### What the Payment Mandate Is

The Payment Mandate is a **separate VDC specifically for the payment ecosystem** — shared with payment networks (Visa, Mastercard) and issuers (banks). Unlike the Cart/Intent Mandates that focus on purchase authorization, the Payment Mandate provides **visibility into the agentic nature of the transaction**.

### Purpose

The Payment Mandate serves three functions:
1. **Signals AI involvement** — Tells the network/issuer that an AI agent initiated this transaction
2. **Signals user presence** — Indicates whether the user was present (human-present vs human-not-present)
3. **Provides authorization proof** — Includes user-signed authorization for the payment

### Who Creates It

The **Merchant Payment Processor (MPP)** constructs the Payment Mandate from the transaction information after the user has authorized the purchase. The Shopping Agent does not create the Payment Mandate — it is assembled on the MPP side from the payment context.

### Payment Mandate Contents

```json
{
  "payment_mandate_contents": {
    "payment_mandate_id": "pm_unique_id",
    "payment_details_id": "order_id",
    "payment_details_total": {
      "amount": {
        "currency": "USD",
        "value": "29.99"
      },
      "refund_period": 30
    },
    "payment_response": {
      "request_id": "order_id",
      "method_name": "CARD",
      "details": {
        "token": "dpan_token_xyz"
      },
      "shipping_address": null
    },
    "merchant_agent": "MerchantAgentName",
    "timestamp": "2025-09-01T12:00:00Z"
  },
  "user_authorization": "eyJhbGc..."
}
```

### Key Fields

- **payment_mandate_id** — Unique identifier for this payment mandate
- **payment_details_id** — Links back to the order/cart
- **payment_details_total** — Transaction amount, currency, and refund period
- **payment_response** — Selected payment method, tokenized credentials, shipping
- **merchant_agent** — Identity of the merchant's agent
- **user_authorization** — User's cryptographic signature
- **timestamp** — When the mandate was created

### How It Flows Through the System

```
1. User authorizes purchase on trusted device surface
2. Shopping Agent sends Checkout Mandate + user attestation to Merchant
3. Merchant submits payment to Merchant Payment Processor (MPP)
4. MPP constructs the Payment Mandate from the transaction context
5. MPP requests payment credentials from Credentials Provider (CP)
6. CP verifies and performs tokenization (if needed)
7. CP returns credentials to MPP
8. Network/Issuer evaluates the mandate for risk assessment
9. Payment authorized (or challenged)
```

### Payment Method Tokenization

The Payment Mandate includes a tokenized payment method (DPAN — Digitized Primary Account Number):
- The actual card number is never exposed to the Shopping Agent
- Credentials Provider handles tokenization
- The token is bound to the specific transaction
- Network/Issuer can resolve the token to the real credentials

### Relationship to Cart/Intent Mandates

- **Checkout Mandate** → authorizes what's being purchased (user → merchant)
- **Intent Mandate** → authorizes the shopping scope (user → agent)
- **Payment Mandate** → authorizes the payment (user → payment ecosystem)

All three work together: the Cart/Intent Mandate proves the purchase is authorized; the Payment Mandate proves the payment is authorized and provides network visibility.

### Refund Period

The `refund_period` field in the mandate specifies the refund window (in days). This is important for:
- Dispute resolution timelines
- Chargeback eligibility
- Merchant liability assessment

### Best Practices

- Always include a valid user_authorization signature
- Link the Payment Mandate to the corresponding Cart/Intent Mandate via IDs
- Include accurate merchant_agent identification
- Set realistic refund periods aligned with merchant policy
- Store Payment Mandates for the full refund period for dispute resolution
- Never expose raw payment credentials to Shopping Agents
- Validate the payment method token before processing

Fetch the specification for exact Payment Mandate fields, token formats, and network integration requirements before implementing.


---
Source attribution: OrcaQubits
Original project: https://github.com/OrcaQubits/agentic-commerce-skills-plugins/blob/30cd25c74c8aa7dc49b3ec4847d463f6104439f6/dist/codex/ap2-agentic-payments/skills/ap2-payment-mandate/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Dave AI.

## Upstream license notice

MIT License

Copyright (c) 2024-2026 OrcaQubits AI (https://orcaqubits-ai.com)

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Dave AI resource metadata

Creator / publisher: OrcaQubits
Original project: https://github.com/OrcaQubits/agentic-commerce-skills-plugins/blob/30cd25c74c8aa7dc49b3ec4847d463f6104439f6/dist/codex/ap2-agentic-payments/skills/ap2-payment-mandate/SKILL.md
Attribution basis: Source repository record

Fields of work: Marketing, Sales
Roles: Business Development, Customer Success Manager, Growth Marketer, Product Marketer, Sales Engineer
Specialties: API
Tools: PayPal, Stripe
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 841af7a44c0092e65375448f1c5fd54860721193a6c14f8b2c695c33e63bab3f