Shopify extends WebMCP checkout access to browser AI agents

Shopify has extended its WebMCP tools into checkout, allowing browser AI agents to read and update a shopper’s checkout and place an order after receiving the buyer’s permission.

The Sept. 28 expansion moves beyond the storefront tools introduced in August, which let agents search for products, manage a cart and guide shoppers to checkout without completing the purchase.

The checkout tools work with the same state shown on the shopper’s page. Shopify’s developer changelog says they "don’t expose a new API or require merchant configuration."

Buyer permission remains essential

Although agents can now submit orders on eligible checkouts, Shopify’s documentation requires them to show the buyer the current order and total before calling complete_checkout, and to "get their permission to place it."

A Web Bot Auth signature, a Shop Pay approval or a status indicating that checkout is ready to complete does not count as consent.

Several steps still require the buyer to take over on the page. These include Shop Pay login, payment challenges such as 3D Secure, blocking UI extensions and review steps. Buyers also handle interactions with app-defined checkout extensions.

The tools cannot accept new card details. Agents can help select a saved Shop Pay card or, where guest checkout permits it, use a Shop Pay approval they have on file. Other payment options must be chosen by the buyer on the checkout page.

sbb-itb-a0ae8a5

Four tools, with checkout limits

According to Shopify’s Checkout WebMCP documentation, eligible checkouts register four tools:

• get_checkout reads checkout information and, after a purchase, order details.
• update_checkout changes contact information, shipping or pickup, discount codes, payment and additional fields such as a tax number.
• complete_checkout places the order.
• navigate_to_storefront returns the browser tab to the store.

Checkout validates each update itself, and agents cannot change the items in the order.

Shopify advises agents to sign browser requests using Web Bot Auth, which the company uses to recognise agents. Requests without that signature may be deprioritised or blocked by bot detection systems.

Availability depends on the checkout setup. Shopify’s standard three-page checkout does not provide WebMCP tools unless the buyer uses Shop Pay. B2B checkout, embedded checkout and checkouts within mobile checkout SDKs are excluded.

The tools also exclude checkouts containing merchandise from another shop, draft orders, order edits and payment collection. Shopify’s storefront documentation currently limits WebMCP use to Chromium-based browsers.

Browser access is not Shopify’s preferred route

Shopify documents two ways for agents to handle checkout. It recommends the server-based Checkout MCP, through which an agent manages a checkout session from its own server.

The company says to use Checkout WebMCP "only when your agent is already operating in the buyer’s browser."

Both routes use the checkout capability of the Universal Commerce Protocol and share the same checkout object. Checkout WebMCP uses tools registered by the checkout page in the buyer’s browser, while Checkout MCP processes requests on the server side.

Shopify says the merchant remains the merchant of record with either method.

Internal test reports faster completion

Gil Greenberg, who is part of Shopify’s team working on agentic commerce, recently shared a company test comparing WebMCP with browser automation, in which an agent reads a page and clicks through it.

Both approaches used GPT-6 Sol "with the same prompts and starting conditions."

Across ten checkout tasks in two test shops, WebMCP completed all 60 attempts successfully. Browser automation succeeded in 56 out of 60.

Excluding page setup time, each attempt took 10.3 seconds with WebMCP, compared with 27.4 seconds using browser automation. WebMCP’s cost per attempt was also 58% lower at OpenAI’s list prices.

The findings have limitations. One line in Greenberg’s post gives a total that does not align with the 60 attempts listed for each method. The test also covered only Shopify’s test shops and a single model. Neither the changelog nor the checkout documentation provides real-world figures for agent-placed orders or conversion rates.

The documentation also leaves some operational questions unanswered: it does not say whether merchants can disable individual tools or identify agent-placed orders separately in reports, and it does not name which agents use the checkout tools.

Read the source