Go SDK for the Agentic Commerce Protocol

Go SDK for the Agentic Commerce Protocol (ACP), targeting the stable API version 2026-04-17.

go get github.com/sumup/acp

Packages

Package	Use
acpcheckout	Serve seller-hosted checkout sessions.
acpcart	Serve seller-hosted pre-checkout carts.
acppayment	Serve delegated payment tokenization.
acpauthentication	Serve delegated 3DS authentication.
acpfeed	Call an agent-hosted Feed API.
acpdiscovery	Serve /.well-known/acp.json.
acpwebhook	Send signed order lifecycle events.
acpauth	Implement bearer-token authorization.
signature	Verify optional signed ACP requests.
discount, extension	Use generated extension models.

Server handlers

The checkout, cart, payment, and authentication packages expose a Provider interface and a net/http handler. Implement the interface, supply an acpauth.Authorizer, and mount the handler directly or into an existing http.ServeMux with WithServeMux.

These handlers validate JSON payloads and ACP headers. Send API-Version: 2026-04-17 and Authorization: Bearer <token> on authenticated service requests. Mutating checkout, cart, and delegated-payment requests also require Idempotency-Key; the OpenAPI definitions describe endpoint-specific exceptions. Discovery is public and does not use those headers.

Providers own persistence, idempotent replay, and conflicts between concurrent requests. The handlers require the idempotency header and pass it through acp.RequestContext; they do not store or replay responses.

Checkout example

Run the in-memory example:

go run ./examples/checkout

Create and complete a session with spec-valid minimal payloads:

curl -sS -X POST http://localhost:8080/checkout_sessions \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer demo-key' \
  -H 'API-Version: 2026-04-17' \
  -H 'Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000' \
  -d '{
        "line_items": [{"id": "latte"}],
        "currency": "eur",
        "capabilities": {}
      }'

curl -sS -X POST http://localhost:8080/checkout_sessions/<session_id>/complete \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer demo-key' \
  -H 'API-Version: 2026-04-17' \
  -H 'Idempotency-Key: 550e8400-e29b-41d4-a716-446655440001' \
  -d '{
        "payment_data": {
          "handler_id": "card_tokenized",
          "instrument": {
            "type": "card",
            "credential": {"type": "spt", "token": "spt_demo"}
          }
        }
      }'

Delegated payment example

go run ./examples/delegated_payment

In another terminal:

curl -sS -X POST http://localhost:8080/agentic_commerce/delegate_payment \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer demo-key' \
  -H 'API-Version: 2026-04-17' \
  -H 'Idempotency-Key: 550e8400-e29b-41d4-a716-446655440002' \
  -d '{
        "payment_method": {
          "type": "card",
          "card_number_type": "fpan",
          "number": "4242424242424242",
          "exp_month": "11",
          "exp_year": "2030",
          "display_last4": "4242",
          "display_card_funding_type": "credit",
          "metadata": {"issuer": "demo-bank"}
        },
        "allowance": {
          "reason": "one_time",
          "max_amount": 2000,
          "currency": "eur",
          "checkout_session_id": "cs_000001",
          "merchant_id": "demo-merchant",
          "expires_at": "2027-12-31T23:59:59Z"
        },
        "risk_signals": [],
        "metadata": {"source": "sample"}
      }'

Feed client

The stable Feed API is hosted by agents and called by merchants. It is a push model: merchants create feed metadata and partially upsert products by Product.id.

country := "US"
client, err := acpfeed.NewClientWithResponses(agentURL)
if err != nil {
	return err
}

response, err := client.CreateFeedWithResponse(ctx, acpfeed.CreateFeedRequest{
	TargetCountry: &country,
})
if err != nil {
	return err
}
if response.JSON201 == nil {
	return fmt.Errorf("create feed: %s", response.Status())
}

See the executable examples on pkg.go.dev for discovery, webhooks, request signing, and feed upserts.

Development

The vendored specs were checked against upstream's stable spec/2026-04-17/ snapshot at commit 7fdd78d. Cart and webhook specifications bundle upstream cross-file references into local components. Unreleased schema changes are excluded. The discovery helper follows the separate discovery proposal.

Generated models and gomock providers use the pinned Go tools in go.mod. Edit the specs, provider interfaces, or generator configuration, then run:

make generate
make fmt
make lint
make test
make vet
make tidy-check

Tests use isolated parallel cases, t.Context(), and testing/synctest for time-dependent behavior. Real HTTP tests and executable examples use local httptest servers. CI runs race-enabled tests in shuffled order on Go 1.26.6 (the module minimum) and Go 1.27, and checks module tidiness and generated-code consistency. Run make generate-check on a clean checkout to reproduce the generation check.

License

Apache 2.0