What Are Verifiable Credentials in AI Agent Payments? W3C Standards Explained

The global agentic commerce market was valued at USD 5.7 billion in 2025 and is projected to grow from USD 7.7 billion in 2026 to USD 65.5 billion by 2033, at a CAGR of 35.7%, according to Grand View Research data published in June 2026.

B2B Centr tracks the infrastructure layer beneath that growth curve, covering the protocols, identity standards, and payment rails that decide whether autonomous transactions actually clear.

Verifiable credentials sit at the center of that layer, because a merchant accepting a purchase from an AI agent needs cryptographic proof that a real human authorized it, within a scope the human defined, before the money moves.

This article breaks down what verifiable credentials are, how the W3C specification family works, how AP2 and Verifiable Intent use them in production payment flows, and what merchants and platforms need to build to accept them.

Key Takeaways

• Verifiable credentials are cryptographically signed, machine-checkable claims issued by one party about another.
• W3C published the Verifiable Credentials 2.0 family as a formal Recommendation on 15 May 2025.
• AP2 wraps agent payment mandates as verifiable credentials, creating an auditable record of user consent.
• Google donated AP2 and Mastercard donated Verifiable Intent to the FIDO Alliance in 2026.
• Merchants verify signature, scope, issuer, and revocation status before authorizing an agent transaction.

The Trust Gap Behind Agentic Commerce Growth

Agent-initiated commerce is scaling faster than the identity infrastructure supporting it.

During Cyber Week 2025, Salesforce recorded AI and agents influencing $67 billion in global sales across $336.6 billion in total spend, touching one in five orders worldwide, and on Shopify's platform in Q1 2026 orders from AI-powered searches arrived at nearly 13 times the year-prior volume.

eMarketer measures the narrowest slice, counting only checkout inside an AI platform, and forecasts $20.57 billion in US retail spending for 2026, around 1.5% of total ecommerce.

The B2B side is larger still. Gartner projects that 90% of all B2B purchases will run through AI agents by 2028, routing more than $15 trillion through machine-to-machine exchanges.

Juniper Research estimates total agentic commerce transaction value in 2026 at $8 billion, reaching $3.5 trillion in 2031.

The estimates vary because the definitions vary, but the direction does not. For a fuller comparison of the competing rails, see our breakdown of agent payment protocols compared: AP2, ACP, x402, and MPP in 2026.

Why Card Networks Cannot Verify an Agent on Their Own

Existing payment infrastructure authenticates a cardholder, not a delegate.

When an agent submits a checkout request, the acquirer faces a question the network was never designed to answer: is this a legitimately delegated agent or a scripted attacker replaying a stolen token?

The fraud economics make that question expensive. Deloitte's Center for Financial Services projects that AI-facilitated fraud losses in the US will reach $40 billion by 2027, up from $12.3 billion in 2023.

In the US, synthetic fraud causes USD 30 to 35 billion in annual losses, and Alloy's 2026 State of Fraud Report notes 8.3% of digital account creations were suspicious, with 44% of firms ranking synthetics as their top threat.

Vectra AI's March 2026 analysis found that generative AI-enabled fraud surged 1,210% in 2025.

Three specific gaps drive the need for a new credential type:

1. Delegation is invisible. A card token proves a card exists. It does not prove a human authorized this specific agent to spend on it.
2. Scope is unenforceable. Traditional authorization carries an amount and a merchant ID, not a constraint like "running shoes under $200."
3. Disputes have no evidence trail. When an agent buys the wrong thing, neither party can produce a signed artifact showing what was actually agreed.

Verifiable credentials close all three. We cover the broader risk picture in is agentic commerce safe.

What Are Verifiable Credentials?

A verifiable credential is a structured, cryptographically signed statement made by one party (the issuer) about a subject, which a third party (the verifier) can validate mathematically without contacting the issuer.

The family of Verifiable Credentials W3C Recommendations provides a mechanism to express digital credentials in a way that is cryptographically secure, privacy respecting, and machine-verifiable, as well as an extension mechanism so that specific applications can use their own terminology.

In agent payments, the claim being made is not "this person is over 18." It is closer to "this human authorized this agent to purchase within these limits until this expiry date."

Because VCs are signed by the issuer's DID key and verifiable against the DID Document without contacting the issuer, they enable trust-minimized credential verification: any party can check credentials offline without requiring a live query to a central authority.

That offline property matters at agent speed. One DID-based zero-trust framework for autonomous microservices achieved 50% lower authentication latency and 75% higher throughput compared to OAuth2 and JWT baselines, by replacing session negotiation with ephemeral access tokens derived from real-time VC verification.

The W3C Verifiable Credentials 2.0 Standards Family

The Verifiable Credentials Data Model v2.0 became a W3C Recommendation on 15 May 2025. The W3C Verifiable Credentials Working Group published seven W3C Recommendations in that release. The core components relevant to payments:

W3C plans to develop v2.1 as part of the Verifiable Credentials Working Group charter, with a planned publication date of 1 April 2027.

The Three-Party Model Applied to a Checkout

The W3C model has three roles. Mapped onto an agent purchase, they look like this:

• Issuer. The user's wallet or the platform that holds the user's key. It signs the mandate expressing what the user authorized.
• Holder. The AI agent. It carries the credential and presents it when a merchant asks.
• Verifier. The merchant, PSP, or issuing bank. It checks the signature, the issuer's identity, the scope, the expiry, and the revocation status.

Each mandate is a VC issued by a wallet the user controls, signed with the user's key, and presented by the agent to the merchant or payment processor.

The merchant verifies the signature and checks the mandate scope before charging.

How AP2 Turns Mandates Into Verifiable Credentials

Google's Agent Payments Protocol is the highest-profile production use of this model.

AP2 was announced on 16 September 2025 with more than 60 launch partners including Mastercard, PayPal, Coinbase, American Express, and Salesforce, and it introduces three signed mandates carried as W3C Verifiable Credentials while treating stablecoin rails as first-class citizens alongside cards and bank transfers.

Launch partners spanned card networks, processors such as Adyen and Worldpay, wallets and crypto rails including MetaMask and ConsenSys, enterprise platforms such as ServiceNow and Intuit, and merchants including Etsy and Lowe's.

The mandate types:

• Intent Mandate. Signed by the user to authorize an agent to shop within a scope, for example "buy size-9 running shoes under $200."
• Cart or Checkout Mandate. Captures the details about and conditions on what the user wants to buy.
• Payment Mandate. Captures the details about and conditions on how the user wants to pay: amount, instrument, timing.Each mandate moves from an Open to a Closed state depending on whether the cart is in progress or finalized, covering both human-present and autonomous transactions.

AP2 v0.2, released April 2026, added "Human Not Present" payments for autonomous agent transactions and supports cards, stablecoins, and real-time bank transfers.

The protocol sits between agent reasoning frameworks such as MCP and A2A and the payment networks themselves, giving merchants a cryptographically verifiable record of what the user authorized, what the agent selected, and what was charged.

If the reasoning layer is unfamiliar, start with our guide to Model Context Protocol explained.

Verifiable Intent and the Governance Shift to FIDO

Mastercard built a complementary framework. Verifiable Intent is aligned with Google's AP2 and the Universal Commerce Protocol, is designed to be protocol agnostic, and creates a tamper-resistant record of what a user authorized when an AI agent acts on their behalf, providing cryptographic proof of authorization that consumers, merchants, and issuers can rely on.

If AP2 defines how intent is created and shared, Verifiable Intent defines how it is proven.

Governance then moved to a neutral body. On 28 April 2026, the FIDO Alliance announced the formation of an Agentic Authentication Technical Working Group and efforts to develop specifications for agent-initiated commerce, drawing from initial contributions from Google (AP2) and Mastercard (Verifiable Intent).

On 26 May 2026, FIDO announced that both had been contributed to it, moving the trust layer of agentic payments beyond any single vendor to the body that standardized passkeys.

Two working groups now drive the work: the Agentic Authentication Technical Working Group, chaired by CVS Health, Google, and OpenAI with Amazon, Google, and Okta as vice chairs, and the Payments Technical Working Group, chaired by Mastercard and Visa.

For the network-level comparison, read our analysis of Visa Trusted Agent Protocol vs Mastercard Agent Pay.

Credentials Versus Tokens: Four Competing Approaches

Not every scheme uses verifiable credentials. The four production patterns in 2026:

Mastercard joined AP2 as a launch partner in September 2025, which means an AP2-compliant agent can pay via Mastercard rails with the AP2 mandate envelope wrapping a Mastercard Agentic Token.

The patterns are complementary rather than mutually exclusive.

DIDs, Agent Identity, and the Standards Still in Flight

Verifiable credentials need resolvable identifiers. W3C DID and VC standards provide the foundation: a subject holds cryptographically signed credentials in a digital wallet and presents them to verifiers without requiring a centralized identity provider.

DID v1.1 reached Candidate Recommendation in March 2026, though most DID methods depend on blockchain infrastructure for resolution, introducing latency and availability concerns incompatible with high-throughput agent delegation.

Several parallel efforts are consolidating:

• The MCP-I specification, donated to the Decentralized Identity Foundation in March 2026, extends the credential model to agents operating within the Model Context Protocol ecosystem.
• The TRAIL did:trail method is a draft DID specification designed specifically for AI agents, defining distinct identifier types for organizations, agents, and self-signed identities, with a W3C registry submission pending.
• The W3C Agent Identity Registry Protocol Community Group, proposed on 22 April 2026, develops open specifications for how AI agents present cryptographically verifiable credentials binding them to their controlling organizations, enabling cross-organizational trust negotiation without pre-existing bilateral agreements.
• W3C published a dedicated Threat Model for Decentralized Credentials in January 2026, cataloguing the attack surfaces that wallet-based architectures introduce.
• NIST's Center for AI Standards and Innovation launched an AI agent standards initiative in February 2026, alongside an NCCoE concept paper on accelerating adoption of software and AI agent identity and authorization.

Privacy: Selective Disclosure and Zero-Knowledge Proofs

A mandate that reveals a user's full purchase history to every merchant is a compliance liability. The specification family addresses this directly.

Securing Verifiable Credentials using JOSE and COSE includes Selective Disclosure for JWTs, which lets a holder reveal only the fields a verifier needs.

Zero-knowledge proofs allow one party to prove the truth of a statement, such as "I hold a valid credential," without revealing the underlying data.

In the agent context, ZKPs enable selective disclosure and transaction unlinkability, preventing verifiers from correlating an agent's presentations across contexts.

This matters for regulated deployments. Disclosure obligations for AI systems are tightening, and our coverage of the EU AI Act and Article 50 transparency duties explains the direction of travel.

Revocation: The Operational Requirement Most Teams Miss

Credentials expire, but they also need to be killable mid-life. If a user's device is compromised or an agent is deprecated, every outstanding mandate signed with that key becomes an attack surface.

Bitstring Status List v1.0 provides a privacy-preserving, space-efficient, and high-performance mechanism for publishing status information such as suspension or revocation of verifiable credentials through use of bitstrings.

A production verifier should therefore run five checks on every presented mandate: signature validity, issuer identity resolution, scope match against the actual cart, expiry, and status list lookup. Skipping the fifth is the most common failure mode in early implementations.

What Merchants and Platforms Need to Build

Practical sequencing for a merchant or platform preparing to accept credential-backed agent payments:

1. Expose machine-readable inventory and pricing. Agents cannot construct a valid Cart Mandate against a catalog they cannot parse.
2. Publish a protocol endpoint. AP2 merchant agents expose a /.well-known/ap2 discovery endpoint and settle against a supported rail.
3. Implement verification, not just acceptance. Validate the credential proof against the issuer's controlled identifier document rather than trusting a header.
4. Store the mandate with the order. The signed artifact is the dispute evidence.
5. Instrument scope violations. Log every case where the cart exceeded the intent scope, because that is the primary abuse signal.
6. Harden the surrounding stack. Credential verification sits inside a broader security posture, covered in our guide to building a resilient cybersecurity stack.

The full checkout-side work is detailed in how to make your checkout AI agent ready.

The Talent Cost of Building This Layer

Credential infrastructure is built by identity engineers, and the market for them is tight.

In the US market, a mid-level IAM engineer typically earns roughly $110,000 to $150,000 in base salary in 2026, senior engineers commonly sit in the $150,000 to $200,000 range, identity architects range from $180,000 to $240,000 or more, and heads of identity reach $200,000 to $300,000 or more.

One 2026 salary guide notes that public sources put the national average anywhere from $70,582 to $152,773, with ZipRecruiter listing "IAM Engineer" at $101,752 in June 2026 and "Identity Access Management Engineer" at $152,773 on 20 July, a $51,000 gap between two ways of writing the same job title.

Glassdoor puts the average identity security engineer at $153,699 per year as of April 2026, with top earners reported at $230,199.

Privileged access management, cloud entitlement management, and identity threat detection tend to pay at the top of the range because the work is high-risk and the talent pool is smaller.

Budget accordingly: a two-engineer credential verification team is a $300,000 to $400,000 annual line item before tooling.

Limitations and Open Risks

Verifiable credentials are not a finished answer. Four caveats worth holding onto:

• Adoption is thin. DID adoption remains limited, and Block abandoned its Web5 DID initiative in late 2024 after failing to overcome wallet UX friction. arxiv
• Resolution latency. Blockchain-anchored DID methods introduce availability concerns at payment throughput.
• Governance is young. The FIDO working groups were formed in 2026 and interoperable specifications are still being drafted.
• Guardrails lag deployment. One Infosys study found only 2% of companies had adequate AI guardrails in place in 2025, and 95% of respondents had experienced at least one AI incident.

Conclusion

B2B Centr covers the standards, protocols, and payment infrastructure that determine which agentic commerce deployments actually reach production.

Verifiable credentials are the mechanism that lets an AI agent prove, cryptographically and offline, that a human authorized a specific purchase within a specific scope.

The W3C Verifiable Credentials 2.0 family, finalized in May 2025, supplies the data model, the signature formats, the identifier resolution, and the revocation mechanism.

AP2 and Mastercard's Verifiable Intent apply that model to real payment flows, and the FIDO Alliance has now taken over governance to keep the trust layer vendor-neutral.

For merchants, the work ahead is concrete: expose machine-readable commerce surfaces, verify credential proofs properly including revocation status, and retain signed mandates as dispute evidence.

Read Next

• Visa Trusted Agent Protocol vs Mastercard Agent Pay: Which Network Layer Wins in 2026?
• Is Agentic Commerce Safe? Fraud and Consumer Protection in AI-Driven Payments
• How to Make Your Checkout AI-Agent-Ready: The Merchant's Guide to Agentic Commerce

FAQs

1. What are verifiable credentials in AI agent payments?

Verifiable credentials in AI agent payments are cryptographically signed, machine-checkable claims that prove a human authorized an AI agent to transact within a defined scope. In AP2 they take the form of mandates, which are structured, cryptographically signed objects that capture what a user has authorized an agent to do.

2. How do W3C verifiable credentials work in an agent checkout?

W3C verifiable credentials work in an agent checkout through a three-party exchange between issuer, holder, and verifier. Each mandate is a VC issued by a wallet the user controls, signed with the user's key, and presented by the agent to the merchant or payment processor, which verifies the signature and checks the mandate scope before charging.

3. What is the difference between a verifiable credential and a payment token?

The difference between a verifiable credential and a payment token is what each one proves. A token proves a payment instrument exists and is valid, while a credential proves a specific human granted a specific agent permission with specific constraints. Mastercard's Agentic Tokens bind a tokenized card credential to a specific agent, merchant scope, and consent policy, and an AP2 mandate can wrap that token to add the consent evidence.

4. Which W3C standard defines verifiable credentials in 2026?

The W3C standard that defines verifiable credentials in 2026 is the Verifiable Credentials Data Model v2.0. It became a W3C Recommendation on 15 May 2025 and describes the extensible data model, how credentials are secured from tampering, and the three-party ecosystem of issuers, holders, and verifiers.

5. Do merchants need to support verifiable credentials to accept agent payments?

Merchants need to support verifiable credentials to accept agent payments when they integrate with credential-based protocols such as AP2, but not when they rely purely on network tokenization or signed header attestation. Four production approaches ship in 2026, spanning Mastercard Agent Pay tokens, Visa Trusted Agent attestations, AP2 Verifiable Credentials, and W3C DIDs.

Disclaimer:
This content is provided for informational purposes only and does not constitute legal, financial, or compliance advice. Protocol versions, governance arrangements, and partner counts cited here reflect publicly announced milestones as of August 2026 and are moving quickly. Adoption figures come from vendor and foundation announcements with differing methodologies and should be treated as directional signals rather than guaranteed outcomes.