Aug 18, 2025

Powered by language models, automation frameworks and intelligent decision engines, AI agents are beginning to transact on behalf of individuals and businesses. They purchase software, pay for content and more. This new form of economic interaction is called "agentic commerce." If you're building a marketplace, software platform or online service, the critical question is no longer "How do I block bots?" but rather "How do I accept verified agents as paying customers?" How To Do Business With Verified Agents I've spent the last 15 years in fintech working at Bloomberg, building blockchain payment systems at Ripple that move hundreds of billions of dollars and exploring transformative tech at Berkeley and Stanford. I started Skyfire to solve a surprisingly big problem: AI agents still can't buy things online. Based on my experience, this article offers a practical, forward-looking guide for companies preparing for the next generation of commerce. Step 1: Define your agentic interface. The first decision you need to make is how AI agents will interact with your service. Broadly speaking, you have two choices: through your website or via an API/MCP (model context protocol) server. Web interfaces offer the advantage of reusing existing infrastructure. If your platform already supports human users making purchases or accessing content through a website, this might be the quickest path to agentic access. However, it requires adapting your bot protection layers to distinguish good agents from malicious bots and tweaking your checkout flow using an agentic commerce platform. APIs and MCP servers are inherently more agent-friendly but less ubiquitous than websites. They expose services in a structured, scalable way that's perfect for agent consumption. The tradeoff is that you must find a way to allow verified agents to get access to your APIs. This is where some payment processing protocols can help by allowing verified agents to get access credentials that leverage your existing authentication, rate-limiting and abuse-prevention mechanisms to ensure access doesn't lead to spam or scraping. In many cases, the best path is a hybrid approach: Expand your existing website to allow agent-compatible access and checkout while building key capabilities for agent access via APIs or MCP servers. Step 2: Make your interface discoverable. Just as SEO made websites discoverable to humans, agents need a way to find services they can safely and legally access. In the world of agentic commerce, discoverability means more than being indexed by search engines. It also helps to be listed in agent-friendly directories that allow agents to identify services that accept verified AI agents as users, offer programmatic access to resources (e.g., APIs, tools and content) and define clear requirements around identity and payment tokens. By registering your service in an agentic directory, you're effectively advertising to a new class of consumers. This step gives you a boost in tapping into the agent-driven economy. Step 3: Accept verified agents. The cat-and-mouse game of bot blocking is coming to an end. As agents become real economic actors, we need to shift from blunt-force blocking to intent-aware authentication. One possible solution is a tokenized identity. Some payment processing protocols can allow agents to pass a verified identity token with every HTTPS request. This token proves who the agent is acting on behalf of, determining whether that's a specific person, business or organization. If you're a website, you could work with bot protection providers to distinguish between malicious bots and verified agents. If you're operating an API or MCP server, consider working with auth providers and requiring identity tokens via an account creation endpoint for on-the-fly credentials via OAuth. This isn't just about security. It's about trust. When you know who the agent represents, you can apply existing access policies, pricing rules and personalization settings, just like you would for a human user. Step 4: Enable account creation via tokens. In most cases, agents will need to create accounts to access your services, especially if your platform supports fine-grained access control or persistent usage data. To support agent onboarding, expose a public create-account endpoint that accepts identity tokens and specifies required identity fields. These tokens carry structured identity fields (e.g., email and phone number) issued by a trusted provider. From there, you can link the new account to a verified principal and apply normal customer identity and access management (CIAM) flows. This token-based flow enables agents to onboard programmatically while still allowing you to enforce identity, rate limits and compliance. Step 5: Support agentic checkout. Agents work best with standardized checkouts instead of needing to dodge botblockers and captchas while filling out forms via screenscraping. They need an entirely programmatic checkout process. That means you must move beyond more brittle browser autofill and instead accept tokenized payments directly via API. These tokens can carry pre-authorized payment methods such as tokenized credit cards, digital wallets (e.g., Apple Pay and PayPal), stablecoins or on-chain assets and account-to-account transfers. When combined with identity tokens, these payment tokens allow agents to present a complete, scoped credential that you can inspect and charge instantly. Think Stripe Checkout but for AI. Building On Open Protocols I'm a strong believer that the best way to scale agentic commerce across the internet is through open standards. This isn't just an API—it's a bridge between agents and services. Open standards in the payment processing space can allow marketplaces, websites and SaaS platforms to accept tokenized credentials from agents, verify the identity of the principal and charge transparently. The Road Ahead Preparing for agentic commerce isn't just a matter of future-proofing. It's a chance to unlock new revenue streams that include agents purchasing content and data on behalf of users, AI workflows calling dozens of microservices per task and developer agents hiring other agents in open marketplaces. All of these require tokenized identity and payments. And from what I've been seeing, all of them are growing today. Agents are here and they want to buy, subscribe and transact. Will your platform be ready? Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?