When an AI agent pays a seller with a Stripe shared payment token (SPT), what stops the seller charging more than the purchase, charging again later, or keeping the card? How do I set the limits, revoke a token and tell when it's been used?

What should I check, step by step?

1. Issue one token per purchase. Set usage_limits[max_amount] to the confirmed total in the smallest currency unit, including tax and shipping, and usage_limits[currency] to the checkout currency.

2. Set usage_limits[expires_at] as close as the checkout allows: minutes or hours for a one-off purchase, not the far-future example timestamp in the docs.
3. Grant the token to the right seller. Pass the seller's Stripe profile in seller_details[network_business_profile], collected during seller onboarding.
4. Only set usage_limits.recurring_interval when the customer has agreed to a subscription. Without it, a seller can't reuse the token for later charges, and Stripe blocks setup_future_usage on SPT payments either way.
5. Subscribe to shared_payment.issued_token.used and shared_payment.issued_token.deactivated, and verify webhook signatures. Show the customer when a payment is made and when the token is finished.
6. Handle shared_payment.issued_token.requires_action. 3D Secure can be triggered by the issuer, the seller or Stripe, and the customer has to complete it on your surface before the token becomes active again.
7. Revoke tokens you no longer need, for example when the user cancels or a checkout times out: POST /v1/shared_payment/issued_tokens/{id}/revoke. Check deactivated_reason afterwards.
8. If you're the seller, retrieve the granted token and read its usage_limits before you create the PaymentIntent, and listen for shared_payment.granted_token.deactivated so you don't try to charge a dead token.
9. Keep your own record of what the agent was allowed to buy alongside the SPT ID. The token caps the amount, but it doesn't know whether the item was the one the customer wanted.

How does a Stripe shared payment token get from an agent to a seller?

Stripe's agent guide sets out the flow. The customer gives the agent a payment method, usually collected with Stripe's Payment Element. The agent issues an SPT to the seller's Stripe profile for that transaction and sends the token ID to the seller. The seller creates a PaymentIntent with it, and Stripe processes the payment. When the PaymentIntent is confirmed, Stripe clones the customer's payment method into a new PaymentMethod for the seller, and refunds and reporting then work as if the seller had been given that payment method directly.

• Supported methods include cards, Link, Apple Pay, Google Pay, Klarna and, with restrictions, Affirm. For cards, Stripe says it may use network tokens from programs such as Mastercard Agent Pay and Visa Intelligent Commerce on the agent's behalf.
• A seller retrieving a granted token sees only limited payment method details, such as the card brand and last four digits, plus the usage_limits.

What do Stripe shared payment token usage limits enforce?

usage_limits is required when a token is created, and it holds the currency, max_amount and expires_at, plus recurring_interval for recurring tokens. Stripe's API reference lists four deactivation reasons: consumed (the allowed amount limit has been reached), expired, revoked and resolved (resolved by a seller). Deactivated is a terminal state.

• A token can move between active and requires_action, for example when 3D Secure is needed, and back again. After the customer completes the action, Stripe sends shared_payment.issued_token.active, unless the token was deactivated in the meantime.
• Recurring charges are allowed only from a token with recurring_interval set (Stripe's example uses month). Stripe rejects setup_future_usage, including the card-specific option, on PaymentIntents created or confirmed with any SPT, and checks off_session separately against the token's permissions.

Does revoking a Stripe shared payment token refund a payment?

Revoking prevents new payments. It doesn't reverse a payment the seller has already created, so refunds and disputes go through the seller and your card issuer as usual. For the Agentic Commerce Protocol, OpenAI's Delegated Payment Spec says OpenAI isn't the merchant of record, and refunds and chargebacks stay with the merchant and its payment provider.

• A seller using another processor can call the SPT Resolve API to get network credentials and submit them to that processor. The token is then deactivated as resolved, and from that point the seller's processor handles the charge. Stripe's own payment flow no longer sees it.
• SPTs are covered by Stripe's Agentic Commerce preview service terms, and the requests in the docs use the preview API version 2026-09-30.preview. Fields and behaviour may change before general availability, so pin the API version you tested and re-read the docs before upgrading.