How an AI agent buys from your store

Updated 2026-08-03

What "an agent buys" actually means

Picture a shopper telling ChatGPT: "build me a cart for a photo shoot under 3000 lei." The AI agent doesn't look at your site with human eyes — it reads machine-readable data, picks products, fills a cart and drives it to payment. And almost always a human confirms the final payment: the agent doesn't spend someone else's money on its own.

This isn't sci-fi for tomorrow, nor a ready sales channel today. In the AI Traffic Index orders from AI are still 0, yet over two weeks on a three-store panel bots logged about 1,005,146 hits, and the single most-read product drew 73,715 requests. Agentic commerce is infrastructure you prepare ahead — not something you scramble to catch up on later.

The agent's path: four steps

The agent finds and reads the catalog. Through the /.well-known/ucp manifest or structured data on your pages, it learns what you sell, at what price, and whether it's in stock.
It assembles a cart. From the catalog the agent picks matching items — by price, availability, attributes — and drops them into an internal cart.
It opens a checkout session. The agent calls the checkout endpoint: it reserves stock, calculates shipping, and gets the final total.
A human pays. The agent shows the shopper the cart and the total, but card entry and the final confirmation stay with the person (human-in-the-loop). That's protection against both mistakes and fraud.

UCP and ACP in plain words

UCP (Universal Commerce Protocol) and ACP (Agentic Commerce Protocol) are emerging standards for how an agent talks to a store: where to get the catalog, how to create a cart, how to open a checkout session. In effect they're an API for an AI buyer instead of buttons for a human.

The key entry point is a manifest file at /.well-known/ucp. It tells the agent: here's the catalog, here's the cart endpoint, here's checkout, here are the rules. Without a manifest the agent only sees what it can scrape off your pages — which takes us back to ordinary AEO markup.

The protocols are young and still shifting. The details live in the separate UCP and ACP guide.

A live demo

Rather than explain it in the abstract, we built a working example. On the agent-demo page an agent runs the whole path on a live store — reads the catalog, picks products, fills a cart and opens a checkout session. You can see which requests it makes and what data it gets at each step, and where it all breaks when the data isn't there.

What your store needs

For an agent to reach checkout, you need four things:

A /.well-known/ucp manifest. The entry point that ties catalog, cart and checkout into one path. The Botmetria Woo plugin serves it for you.
A machine-readable catalog. At minimum, valid JSON-LD Product with price, priceCurrency and availability. Without a price and stock status the agent can't build a cart.
A checkout-session endpoint. Where the agent sends the cart and gets the total with shipping; this is also where stock is held.
Human-in-the-loop payment. The final step isn't an auto-charge — it's the shopper confirming.

Step	What the store needs	What the agent sees
Discovery	`/.well-known/ucp` manifest	Where catalog and checkout are
Catalog	JSON-LD Product, feed	Price, currency, availability
Cart	Cart endpoint	Items and quantities
Checkout	Session endpoint	Total and shipping
Payment	Payment link	Confirmation screen for the human

A realistic take

Don't sit and wait for a flood of orders. What's happening now is different: agents and AI assistants read your catalog to name your price and stock in their answers. If the data is broken — product images returning 403/406 to bots, or no availability in the markup — you drop out of AI answers well before agentic buying goes mainstream.

A practical order of work:

First cover the AEO basics: product markup, availability, shipping, clean bot access.
Check that you're being read at all — run the free Botmetria audit.
Then add the manifest and a checkout endpoint for agents.

Common mistakes

Shipping the manifest before the data. A manifest with no valid catalog is an empty storefront. JSON-LD and stock first, protocol second.
Expecting the agent to "figure out" the HTML. An agent doesn't click buttons or read banners — it needs data, not design.
Blocking AI bots. If the agent can't read the catalog, it never reaches the cart. Classic Googlebot/Bingbot, of course, you never touch.
Auto-charging with no human. Don't strip the confirmation step — it breaks trust and raises the risk of chargebacks and returns.

Stores that take the first step now will be ready for agentic commerce without a panic — instead of rewriting the catalog the day the first agent shows up for a cart.

FAQ

Can an AI agent pay for the order by itself, without a human?

No. In the UCP/ACP flow a human confirms payment: the agent reads the catalog, builds the cart and opens a checkout session, but card entry and the final yes stay with the shopper. It's built-in protection against mistakes and fraud.

Do I need a /.well-known/ucp manifest if I already have JSON-LD?

JSON-LD gives the agent price and stock, but the manifest ties catalog, cart and checkout into one path. A full agentic purchase needs both, and you should start with valid JSON-LD Product — without it the manifest just leads to an empty storefront.

Are there real orders from AI agents yet?

In the Botmetria AI Traffic Index orders from AI are still 0, even though bots read catalogs hundreds of thousands of times. Right now this is infrastructure prep, not a ready sales channel — which is exactly why there's time to do it calmly.

How do I check whether my store is ready for agent purchases?

Run the free URL audit: it gives a 0–100 AI-readiness score and shows whether product data, availability, logistics and bot access are readable. The weak categories are exactly where an agent would get stuck on the way to the cart.

Related guides

Check your store for free

A 60-second audit shows how ready your store is for AI agents — and exactly what to fix first.

Run the free audit