Specoria
Menu
TR Free test

InsightsAgentic commerce

Agent pays, human approves: what Stripe and Polar shipped this week, and what it means for stores

Stripe and Polar both shipped agent payments this week with the same rule, a person approves before money moves. How scoped payment tokens work, where they apply and what a store can do now.

By 5 min read

An agent finds the right product, fills the cart and reaches the payment step. Then it stops and asks a person: this store, this amount, this currency, go ahead? Only after a yes does any money move.

That pause is now the default design. In the space of two days, two payment companies shipped agent payments, and both put a human approval in front of the charge. This article looks at what was released, how the scoped payment token behind it works, where it applies, and what a store should check on its own side.

This article is for information only and is not legal or financial advice.

What shipped

Polar. On 26 October 2026, Polar opened agentic payments to every organization on its platform. The change, published in Polar's open source repository, removes the per-organization gate and describes the feature as agentic payments built on Stripe shared payment tokens. Polar's announcement on X put it in one line: agents can now pay on any Polar checkout, with your approval.

Stripe. On 27 October 2026, Stripe announced stripe pay, a command for instant business-to-business transfers from the Stripe CLI. The recipient is identified by a Stripe profile handle, not a guessed name. The instructions written for agents are strict: review the transfer in machine-readable output first, and add the final confirmation flag only after the user confirms the recipient, amount, currency and source account. A dry run validates the flow without sending anything.

Two different products, one rule: the agent prepares, the person approves.

How a scoped payment token works

The mechanism under Polar's checkout is the Stripe shared payment token (SPT). Stripe's documentation describes it as a way to give a seller scoped access to a customer's payment method for an agent-initiated purchase.

The agent proposes a purchase, the person approves it, and the seller receives a token limited by amount, currency and time
Approval comes first; the token the seller receives can only do what was approved.

In practice:

  • The customer gives the agent a payment method once. The agent never passes card details to the store.
  • The agent issues a token for one purchase. The token is granted to a specific seller's Stripe profile and carries usage limits: currency, maximum amount and an expiry time. Stripe's documentation says the agent sets the maximum amount to match the total of the transaction.
  • The seller charges against the token. The payment then behaves like any other card payment for refunds and reporting.
  • The token ends. Stripe notifies the seller when a token is consumed, expired or revoked by the agent; a revoked token can't be charged.

Stripe's own test tool for live mode makes the approval explicit: a spend request can be created with a flag that asks the person to approve it before the token is issued. The API is still a preview, version 2026-09-30.preview.

For a store, the important part is the shape of the limit. An agent can't spend more than the person agreed to, at a different store, or next month. If the cart total changes after approval, the token no longer covers it.

Where it applies, and where it doesn't yet

Stripe lists 34 countries for shared payment tokens: the United States, Canada and 32 European countries, including the United Kingdom. Türkiye is not on the list.

Countries where Stripe shared payment tokens are available, and what a store in Türkiye can prepare today
SPT covers the US, Canada and 32 European countries; for a store in Türkiye the open steps are discovery, cart and a clear checkout.

The same pattern holds for the other agent payment routes we track on our protocol map: they open first in the US and Europe. For most stores in Türkiye, an agent paying by token is not something to build this month.

What does apply everywhere is the step before payment. An agent can only ask for approval on an order it has understood: the right product, the right variant, a total it can read. If it can't get that far, the payment rail doesn't matter.

What a store can do now

If you sell in a covered country and use Stripe, check whether your checkout can accept a shared payment token, and test it in a sandbox before any agent tries it with a real customer. Stripe's documentation includes a test helper that creates a token with example limits.

Wherever you sell, make the approval easy to give:

  • Show the full total before the last step. Product, variant, quantity, shipping and taxes as text on one page, so the agent can put an exact figure in front of the person.
  • Keep prices stable between cart and payment. A token limited to the approved amount fails if the total moves after approval.
  • Name your payment methods in text, on the product page and at checkout. An agent has to know what you accept before it asks the person to approve anything.
  • Write down your own limits. Decide above which amount an order needs an extra confirmation, and keep a record of what was approved. When a dispute comes, that record is the evidence; see who pays when a shopping agent gets it wrong.

How Specoria looks at this

The identity, authorization and payment checks in our method include a defined per-transaction limit and approval threshold, and a transaction audit trail. That is the same model Stripe and Polar chose. Shared payment tokens now sit on the list of payment routes we follow, next to ACP, UCP and AP2, with the country list kept up to date.

Our agent simulator runs a real browser agent on your store and shows where it stops before payment. That is the part of the path every store controls today.

Sources