Shopify WebMCP Checkout: The Intent/Authorization/Settlement Split, Live in Production

The short answer: on September 28, 2026, Shopify extended WebMCP to checkout. Browser-based AI agents can now read a checkout, update it, and submit the order — after the buyer authorizes it. Shop Pay is included. Zero merchant configuration.

Every outlet covered the announcement. None covered the authorization architecture — which is the real story.

What shipped

Three new checkout tools (per Shopify's Sept 28 developer changelog, via Unite.AI):

• get_checkout — reads checkout state, messages, post-completion order details
• update_checkout — updates supported checkout fields (address, delivery option, discounts)
• complete_checkout — submits the checkout, only after buyer confirmation
• navigate_to_storefront — returns the tab to the storefront

They run inside checkout-web, share the checkout UI's state, expose no new API, and require no merchant configuration. This builds on native WebMCP activated August 5 across all Liquid storefronts (catalog + cart tools: search_catalog, update_cart, proceed_to_checkout).

The authorization line

The agent can READ, EDIT, and SUBMIT. The agent CANNOT input payment credentials — control hands back to the buyer whenever input is required (3D Secure, blocking UI extensions). The buyer explicitly authorizes the purchase.

That's the intent / authorization / settlement split the six-bank "Building Trust in Agentic Commerce" report (Sept 22) and the GFF regulators (Sept 25) demanded — now shipping as product on a major commerce platform.

The context: Amazon and Adidas are blocking agents from purchasing (TechCrunch, Sept 28 — "and Adidas, apparently!"). Shopify bet the opposite way. Muse and Instinct already have direct Shopify partnerships. The platform war for agentic checkout is on.

Two systems, one protocol

• WebMCP — agents in the buyer's browser (today's news)
• Hosted MCP server — Shopify's server-to-server agent system
• Both use Universal Commerce Protocol (UCP) for discovery, cart, and checkout.

Why this makes the payment gate MORE important, not less

Shopify's "buyer confirms" is the human-confirm band made standard. But buyer confirmation proves WHO agreed — not whether the agreement was wise. That's the $78k Codex lesson, and exactly the gap the per-payment confidence gate fills: the machine-native layer that scores the instruction before it reaches human confirmation.

Live receipts, tested ~20:18 EDT Sept 28 on our gate (decider local-heuristic-v1, calibrated=false):

The honest finding: the heuristic is conservative by design — it escalates even the read-only pattern, because it keys on agent+checkout+payment instruction language. It scores the instruction text, not the buyer's actual confirmation state — which it cannot see. Shop Pay's buyer confirmation and the confidence gate are complements, not competitors.

The merchant angle nobody covers

It's on by default. Merchants don't install an app, flip a setting, or write code — WebMCP tools were pre-registered on storefronts (Aug 5) and checkout arrives the same way. Any eligible merchant store on the platform is now agent-purchasable out of the box — including ours (ScriptMasterLabs sells 9 high-ticket products on Shopify). Rollout is to "all eligible Shopify merchants" — eligibility terms weren't detailed in the Sept 28 coverage; that's the piece to watch.

Honest costs

1. Chromium-only: WebMCP is a Chrome origin trial (Chrome, Edge, Brave). Safari/Firefox out. Google and Microsoft back the standard — the best signal Safari support comes eventually.
2. Eligibility fine print: "all eligible merchants" is undefined in the coverage so far.
3. Buyer confirmation is a human gate, not a machine gate — the scored-decision layer still needs to exist between the instruction and the confirmation.
4. Shopify docs/changelog pages weren't independently opened for this piece — announcement is press-coverage based.

Full dated receipts, claim receipts, and a 5-minute merchant checklist:

Canonical version with live receipts: https://scriptmasterlabs.com/shopify-webmcp-checkout