Visa TAP: How Can a Merchant Recognize a Shopping Agent?

An automated program checks a merchant’s sizes, stock and prices. It could be a user-authorized shopping agent, an ordinary crawler or a malicious program. A machine-originated request alone does not identify which.

Visa’s Trusted Agent Protocol (TAP) describes verifiable requests to help merchants recognize agents and interaction intent within a trust framework. It also describes signing mechanisms for consumer identification and payment information. See the TAP specification.

This is a hypothetical explanation of public specifications, not an integration or payment test. Sources reviewed October 28, 2026. Visa says the product is in development and deployment; availability may vary by market. See Visa’s product page.

sequenceDiagram participant A as Shopping agent participant M as Merchant or site protection participant K as Trusted public key source A->>M: Product request with signature and intent M->>K: Find verification key K-->>M: Return matching public key M->>M: Check signature, expiry and replay protection M-->>A: Allow, limit or reject under merchant policy

Visa’s merchant specification builds on HTTP Message Signatures and describes validation of signatures, time, key identifiers and purpose. A valid signature can help establish that a request came from an agent in the trust framework and that covered data has integrity; the merchant still decides how to handle traffic.

Three separate questions

Question	What is checked?	Related TAP mechanism
Which agent is this?	Was the request signed by a trusted agent?	Agent recognition signature
Whom does it represent?	Can consumer or device information be verified?	Consumer identification data, where applicable
How is payment information provided?	Does payment data and associated information meet the agreement?	Payment containers and related mechanisms, depending on the interaction

A valid signature does not automatically mean a user approved a specific item, an issuer will approve the transaction, or a merchant must accept the order. Agent identity, user authorization and card approval have different decision-makers and steps.

Why merchants and developers care

Site protection must distinguish useful automated shopping from malicious traffic. Recognizing an agent under a merchant’s trust policy might permit a more suitable product or checkout experience. A signature remains one input: rate, product limits, privacy, inventory and fraud also matter.

For developers, adding a header is not enough. Check network participation, key management, request signing and merchant acceptance; verify actual availability by market, merchant and payment method.

TAP helps recognize and validate requests and associated information; ACP and UCP focus on commerce flows, and AP2 on verifiable authorization. These may play complementary roles, but a combination requires explicit support.

Further reading: Visa merchant specification, getting started and product availability.