Skip to content
Webclat | Goods

AGENTIC COMMERCE

Some of your customers are not using a browser

The Agentic Commerce Protocol from OpenAI and Stripe has been processing live transactions since September 2025 and is expanding across Shopify merchants; Google launched a competing protocol in January 2026 into AI Search Mode and Gemini. Orders through those surfaces reach your bank and never reach your analytics. Below is a working one, and what each destination recorded when it happened.

The version of this claim you have probably heard is wrong

“AI agents don’t trigger client-side JavaScript” is the line in circulation, and it is too broad. An agent driving a real browser runs your tags perfectly normally. Only protocol checkout is genuinely invisible, and it is invisible for a structural reason rather than a technical one: it is a separate surface, not a browser with scripting switched off.

Stated accurately the problem is bigger than the sloppy version, not smaller. Agent traffic breaks measurement in three different ways that need three different fixes - and one of the three is not a gap in your data at all, but a distortion of numbers you already trust.

Three modes, three failures

A. Browser-driving agent

not built

Operator, Claude in Chrome, Playwright-driven agents

Runs your tags
Yes - a real browser, a real JS engine
How measurement fails
Tracked, but MISATTRIBUTED. The session looks human: your tags fire, the events are valid, and the visitor is counted as a person. They fill forms instantly, never hesitate, navigate flawlessly and move no pointer, so they quietly distort every behavioural metric and inflate session counts while contributing almost no orders.
The fix
Behavioural segmentation, so agent sessions can be separated from human ones rather than polluting the funnel.

B. Protocol checkout

demonstrated

ACP (OpenAI + Stripe), UCP (Google)

Runs your tags
No - the storefront is never loaded
How measurement fails
INVISIBLE to every client-side destination. The agent reads a structured feed and transacts through REST endpoints with a delegated payment token. There is no document, so there is no DOM, so there is no JS engine for a vendor tag to exist inside. Revenue arrives with no analytics record of it at all.
The fix
Server-side collection on the protocol surface itself. Demonstrated below, end to end.

C. Crawler

detected

GPTBot, ClaudeBot, PerplexityBot

Runs your tags
Usually not, though this is changing
How measurement fails
Invisible unless caught server-side - and where a bot filter misses one, it counts as a session that never converts, pushing every rate down.
The fix
Server-side classification from the request headers, before anything is stored.

Mode A is marked not built here, and that is the honest state: distinguishing an agent-driven browser from a person by user agent alone does not work, and behavioural detection is scoped rather than shipped. Mode C classifies from request headers server-side today, before anything is stored.

Mode B, working

This property exposes a real ACP-shaped surface: a discovery document at /.well-known/acp/config.json, a structured product feed, and the specification’s five checkout endpoints - create, get, update, complete, cancel. The delegated payment token is a simulated shape scoped to one session and one amount, and it is re-minted whenever the basket changes, because a token authorised for one total must not settle another. No payment is taken and no card field exists anywhere in this codebase.

What the panel below does and does not prove

The panel runs in your browser, so a browser does make its HTTP calls - it would be silly to pretend otherwise. What makes this Mode B is that no storefront page is rendered and no vendor tag executes: the requests are the same requests an agent sends, and the resulting order carries no page context because there is no page. For a genuinely browserless run, use the curl transcript underneath - that is the version worth handing to your engineer.

Run it

Complete an order through the protocol surface

Needs the demo token, because a protocol order rides as verification traffic and therefore reaches billed vendors. Paste it and the panel opens a session and completes it against WC-POL-003 at $6. Nothing is charged and no card field exists anywhere in this codebase.

The same thing from a terminal, with no browser at all

Discovery and the feed are public. The checkout endpoints need the demo token, because a protocol order rides as verification traffic and therefore reaches billed vendors - an open endpoint would let a stranger spend our vendor allowance.

# 1. Discover the merchant. No page, no token.
curl -s https://store.webclat.com/.well-known/acp/config.json

# 2. Read the product feed. This is where an agent "browses".
curl -s https://store.webclat.com/api/acp/feed

# 3. Open a checkout session.
curl -s -X POST https://store.webclat.com/api/acp/checkout \
  -H 'content-type: application/json' \
  -H 'x-bulk-token: <demo token>' \
  -H 'x-agent-platform: acme-shopping-agent/1.0' \
  -d '{"line_items":[{"item_id":"WC-POL-003","quantity":1}]}'

# 4. Complete it with the delegated token the session returned.
curl -s -X POST https://store.webclat.com/api/acp/checkout/<id>/complete \
  -H 'content-type: application/json' \
  -H 'x-bulk-token: <demo token>' \
  -d '{"payment_token":"<token from step 3>"}'

Step 4 answers with the order and a measurement block: the canonical event we minted, both warehouse verdicts, and every server-side vendor’s own status code. A real deployment would not return that block - measurement is not the agent’s business - and it is here because the asymmetry is the exhibit.

Two things the order deliberately does not claim

Advertising consent is denied, so some vendors are withheld

A delegated payment token authorises a purchase. It does not carry a visitor’s advertising consent, and there is no banner in this channel to have asked. So protocol orders are marked functional and analytics consent granted, advertising denied - and destinations requiring advertising consent report skipped-consent. That is the correct outcome and it is part of the exhibit, not a gap in it. Whether a merchant can lawfully retarget an agent-driven buyer is a real open question, and inventing a permissive answer here would be the wrong kind of confident.

There is no prior visitor to stitch onto

A protocol order arrives with no cookie and no device history, so its identifier is minted from the session and nothing else. There is no earlier anonymous browsing to join it to, because there was none. Identity resolution has to answer for that rather than paper over it, and any vendor claiming to unify this channel with your web visitors on day one is describing something they cannot do.

“We already use Enhanced Conversions”

Almost everyone does, and they should - it is the right answer to the problem it solves. It is also the first thing raised when this channel comes up, so here is the distinction that matters: Enhanced Conversions feeds the bidder. It does not give you a report.

What it genuinely fixes

A hashed email goes to the ad platform, which matches the conversion to a signed-in user who saw an ad. Bidding signal is recovered without a cookie, and for a protocol order the merchant does receive contact details - it has to, to fulfil the order - so there genuinely is an email to hash. This is not a workaround; it is the same mechanism that closes the loop for phone and in-store sales.

What it leaves open

It is an OUTBOUND feed. Nothing comes back, so you still cannot answer “how much revenue arrived through agents last month” from your own reporting. And it is per-platform: Google gets its upload, Meta needs its own, then the next network - each ending up with a partial view on its own definitions, none of them reconciling with each other or with your site traffic. It solves the ad platform’s problem completely and yours not at all.

And on agent orders specifically, check the consent before you upload

Enhanced Conversions means sending a customer’s email to an ad platform. On a protocol order that customer never saw a consent banner, because there was no page to show one on. So an advertising-consent setting collected from web visitors does not cover them, and inheriting it is a decision made by accident. That is exactly why this property marks protocol orders advertising-denied and lets the Meta leg report skipped-consent above, rather than quietly passing them through. Whoever bolts Enhanced Conversions onto this channel without asking the question is uploading PII from customers who were never asked.

The conclusion is not “stop using it”. It is that every vendor-side fix is necessarily per-vendor, because each platform can only see its own agent - so the one place a single reconcilable number can exist is a warehouse you own. That is an argument about where measurement lives, not about which tag is best.

Every order placed here is synthetic verification traffic against a fictional catalogue, and this property publishes no client outcomes - deliberately, and stated. To see what unmeasured traffic is worth on your own numbers, the signal-recovery calculator has a protocol-checkout line - it defaults to zero, which is the right answer for most merchants today and the reason this page exists now rather than later.