Answers · agent payments
OpenAI launched ChatGPT Wallet on November 13, 2026 so a ChatGPT dot can pay for things for me. Can the agent buy something without my approval, can I set a spending limit on it, and what does a store have to do to accept Wallet payments?
Last updated
TL;DR: Not at launch. OpenAI says every ChatGPT Wallet purchase needs your approval: before each one you review the merchant, items, total, selected card and any shipping or recurring-payment terms, then approve with a biometric check such as Face ID or Touch ID on a supported device. Only then does the payment network issue a payment token (a substitute card number, security code and expiry date) that the dot uses at checkout, so neither the agent nor the store sees your real card number. There's no spending limit to set yet, because nothing is pre-approved: OpenAI says it expects to let users delegate purchases later with spending limits, categories or time periods, but that isn't available now. Wallet is rolling out to US ChatGPT Pro subscribers aged 18 and over, inside dots only, with eligible US-issued American Express, Chase, Mastercard and Visa credit cards (no debit cards, no virtual cards at launch). For stores, OpenAI's Accept payments guide says it works with existing checkout pages with no Wallet-specific integration: the store receives a network token, not the card number, and may use it only for the purchase the customer approved. The practical work is not blocking ChatGPT's signed cloud browser (Web Bot Auth) and getting risk systems to stop declining legitimate agent purchases, helped by user signals OpenAI is starting to send in the Forwarded header.
What should I check, step by step?
1. Read the whole approval screen every time, not just the total: merchant, items, selected card, shipping and especially any recurring-payment terms. A subscription you approve lets the merchant store the credential and charge it again under those terms.
- Treat "Ready to check out" as your approval only. OpenAI's help page says it doesn't confirm the merchant placed the order, so check for the merchant's confirmation before asking the dot to try again, or you can end up paying twice.
- Don't wait for a Wallet spending limit to protect you. None exists at launch; the per-purchase biometric approval is the control, so decline anything you don't recognize.
- Know who handles what: the merchant for order status, returns and refunds; your card issuer for declined, pending, disputed or unrecognized charges; OpenAI Support for a purchase different from what you approved.
- If you run a store, check that your CDN or firewall recognizes ChatGPT's Web Bot Auth signatures instead of blocking its cloud browser as an ordinary bot.
- Ask your fraud and payment providers how they recognize agent purchases and whether they read the Forwarded header parameters (asn, ip-prefix, ip-country, locale, tz, user-agent) OpenAI is rolling out.
- Use the network token only for the order the customer approved. For repeat purchases, rely on your own recurring-billing consent and merchant-initiated transaction rules, and use the Payment Account Reference (PAR) to link the token to the customer's account.
How does a ChatGPT Wallet purchase get approved?
You add a card once, either by asking your dot or under Wallet in Settings, entering the details in a secure form rather than in chat. Your bank may ask you to verify the card; for Chase cards you approve the connection in the Chase mobile app and must be the primary cardholder. Saving a card and approving a purchase are separate steps.
- When the dot reaches checkout, a purchase request appears. You select Approve and complete biometric verification; if your current device can't do that, a link or QR code moves the approval to a supported device signed in to the same ChatGPT account. OpenAI says each approval creates a record of the purchase you authorized the agent to make.
- After approval, the dot completes checkout with a network token linked to your selected card, so the number the store sees can differ from the one on your physical card. You keep the card's rewards and its protections for eligible disputes, for example a defective item. Removing a card from Wallet stops new Wallet payments with it but doesn't cancel existing orders or close the card.
Can you set a spending limit on ChatGPT Wallet?
There are no per-purchase or monthly caps, merchant allowlists or category rules to configure at launch, and no way to let the dot buy without asking. OpenAI describes those as the direction it expects to take: delegation with parameters such as spending limits, purchase categories or time periods, pre-approved with biometric checks and records of authorization.
- The approval binds what you saw on the screen, not what happens afterwards at the store. Recurring charges you agreed to continue under the merchant's terms and are cancelled with the merchant. A checkout that stops responding may still have left a pending charge, which OpenAI tells you to raise with the merchant and your card issuer before retrying.
- Wallet isn't available in Chat, Work or standalone Codex threads, only in conversations with a dot, and it may not complete checkout at every store.
What does a website need to do to accept ChatGPT Wallet payments?
OpenAI's Accept payments guide says Wallet works with existing checkout pages and payment forms and needs no Wallet-specific integration. The customer approves in ChatGPT; your checkout processes the payment, and your business keeps the order, fulfillment, customer support and fraud decisions. Customers can also keep paying with a card already saved with you.
- The guide is explicit that the customer consents only to the specific transaction: don't reuse or save the Wallet credential for a separate purchase. Subscriptions are allowed if your checkout supports recurring billing, with the customer's consent and your processor's practices for merchant-initiated transactions.
- Risk systems tuned against bots can decline ChatGPT's cloud browser by accident. OpenAI is rolling out user signals in the Forwarded HTTP header (asn, for, ip-country, ip-prefix, locale, tz and user-agent) and says the signals you receive may vary while support rolls out. Its launch post names fraud partners Forter, Riskified, Sardine and Signifyd and payment providers Adyen, Checkout.com and Stripe as working on recognizing legitimate agent purchases.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “A customer's ChatGPT dot just completed an order on our store with a ChatGPT Wallet network token. Record the order with the agent signer we verified and the consent scope, with no card or customer details, so we have our own record if the order is questioned later.”
{
"tool": "record_action",
"arguments": {
"action_type": "commerce.agent_checkout",
"outcome": "success",
"occurred_at": "2026-11-13T19:30:00Z",
"client_event_id": "order-104233:chatgpt-wallet",
"summary": "Order 104233 placed by a ChatGPT cloud browser session (Web Bot Auth signature verified at the CDN); paid with a ChatGPT Wallet network token; consent scope single purchase, credential not stored for reuse; Forwarded ip-country=US; risk decision approve"
}
}- Needs your API key (or accept_terms:true once to open a free account; the key comes back once). It returns a ledger-committed receipt showing what you recorded and when. It proves the entry was submitted, not that the order or the customer's approval happened as described.
- It doesn't see the customer's Wallet approval, the network token or PAR, read your CDN or fraud tools, or decide whether to accept an order. Keep card data, names and addresses out of summary; hash your internal order record and send it as action_sha256 if you need to tie the receipt to it.
Rightshold isn't affiliated with OpenAI, American Express, Chase, Mastercard, Visa or any provider named here, never holds or moves money, and isn't a wallet, card issuer or payment processor. ChatGPT Wallet behavior is as described in OpenAI's November 13, 2026 announcement, its Help Center article on making purchases with ChatGPT Wallet and its Commerce Accept payments guide, all read November 13, 2026, during a limited rollout; availability, eligibility and controls may change. Not financial or legal advice.
What are the sources?
- OpenAI: Introducing ChatGPT Wallet (November 13, 2026)
- OpenAI Help Center: Making purchases with ChatGPT Wallet
- OpenAI for Developers: Commerce, Accept payments (network token, single-transaction consent, Forwarded header)
- OpenAI for Developers: Agentic Commerce (Commerce Partner Playbook index)
- Rightshold: record an action, get a receipt
Related
- How to require human approval before an AI agent spends money
- Can you dispute a purchase your AI agent made with your card?
- How do Visa Intelligent Commerce mandates cap what an AI agent can charge to your card?
- How to let a headless-browser AI agent complete checkout without turning off bot protection
- How to verify which AI agent is hitting your site with Web Bot Auth
- How to stop an AI agent from paying twice when it retries
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'