How to let ChatGPT and other AI agents buy from your store
- Type
- Applies to
- Medusa v2.x
- Updated
Short answer
To let ChatGPT buy from a custom store, implement OpenAI's Agentic Commerce Protocol (ACP): a product feed, checkout session endpoints, delegated payment, and order webhooks. Google AI Mode and Gemini use UCP with AP2 instead. Medusa has an official ACP guide with example code; UCP and AP2 are custom work today.
What does an AI agent need from your store to buy from it?
An AI agent needs three layers from a store before it can complete a purchase: discovery, checkout, and payment. Each AI platform defines these layers in its own protocol. Selling through an assistant means implementing the protocol that assistant uses.
Assistants that support the Model Context Protocol (MCP), such as Claude and ChatGPT, can also call tools that a store exposes through an MCP server. MCP is a general tool protocol, not a checkout standard.
Before you start
- A Medusa v2 application with published products, a region, and a sales channel.
- The Stripe Payment Module Provider. Medusa's ACP guide notes that ChatGPT currently supports only Stripe as a payment provider.
- Approval from OpenAI. Product feed onboarding in ChatGPT is open to approved partners, who apply at chatgpt.com/merchants.
- Public privacy policy and terms of service URLs. OpenAI's feed spec requires them for checkout eligibility.
1. Publish a product feed
The product feed is how ChatGPT indexes your catalog. OpenAI's file upload spec takes full catalog snapshots over SFTP, in parquet, jsonl.gz, csv.gz, or tsv.gz, at least once a day.
In Medusa, you build the feed in a workflow that reads products, prices, and inventory, and run it from a scheduled job. Medusa's ACP guide shows this pattern, but its upload step only logs the feed. You write the delivery code once OpenAI gives you access.
2. Add the checkout session endpoints
OpenAI's Agentic Checkout Spec defines the REST endpoints ChatGPT calls on your backend. In Medusa, each one is a custom API route that runs a workflow over Medusa's cart:
- Copy to clipboard
POST /checkout_sessionscreates a cart with the requested items. - Copy to clipboard
POST /checkout_sessions/{id}updates items, the address, or the shipping option. - Copy to clipboard
GET /checkout_sessions/{id}returns the current state. - Copy to clipboard
POST /checkout_sessions/{id}/completecompletes the cart and creates the order. - Copy to clipboard
POST /checkout_sessions/{id}/cancelcancels the session.
3. Authenticate and verify every request
ChatGPT sends a bearer token and a Copy to clipboardSignature header with each checkout request. The Medusa guide adds a middleware that checks the token against a Medusa secret API key and verifies the signature with HMAC-SHA256, using the signing key OpenAI issues.
4. Charge the delegated payment
OpenAI's Delegated Payment Spec passes your payment provider a one-time token with a maximum amount and an expiry. Stripe's Shared Payment Token is the first compatible implementation. The Medusa guide passes this token to the Stripe provider when it completes the cart.
5. Send order webhooks
ChatGPT tracks order status through webhooks you send. The Medusa guide uses a subscriber on Copy to clipboardorder.placed and Copy to clipboardorder.updated to post these events.
6. Pass certification and go live
OpenAI's production guide lists sandbox tests to complete before launch: sessions with and without an address, shipping updates, payment tokens, order completion, signed webhooks, errors, and idempotency. You stay the merchant of record and handle refunds and chargebacks.
Which agentic commerce protocols does Medusa support?
Medusa's support for agentic commerce protocols today:
How does this compare with Shopify?
Shopify runs UCP-compliant MCP servers for every Shopify store, described in its agent tools docs, for agent builders who shop on buyers' behalf: catalog search, Cart MCP, Checkout MCP, and order webhooks. On Shopify, the platform runs those endpoints. On a custom or headless backend such as Medusa, you implement each protocol yourself, on top of Medusa's cart, order, and payment logic.
When is Medusa not the right choice?
- You have no developer. ACP on Medusa is code your team writes and maintains.
- You need Google AI Mode checkout without engineering work. Medusa has no UCP guide yet.
- You sell products OpenAI prohibits, such as alcohol, nicotine, or weapons. No backend changes that.
Common questions
Does Medusa have a plugin for ChatGPT Instant Checkout?
No. Medusa provides an official tutorial with example code for the Agentic Commerce Protocol, which you add to your own Medusa application. The tutorial's product feed upload step is a stub you complete after OpenAI approves you.
Which payment providers work with ChatGPT checkout?
OpenAI names Stripe's Shared Payment Token as the first implementation of its Delegated Payment Spec, with more providers to follow. Medusa's ACP guide uses the Stripe Payment Module Provider.
Who is the merchant of record when ChatGPT places an order?
The merchant is. OpenAI states it is not the merchant of record in the Agentic Commerce Protocol, so your store charges the payment and handles refunds and chargebacks.
Can I sell through Google Gemini with Medusa?
Not out of the box. Google AI Mode and Gemini use the Universal Commerce Protocol (UCP), and Medusa has no UCP guide yet, so you would build the endpoints as custom API routes and workflows.