Auth0 launches AI Identity for Agentic Commerce: who gets authenticated when an AI agent buys
A breakdown of Okta's new Auth0 capabilities: what merchants must verify when a purchase arrives through ChatGPT, how CIMD agent registration and on-behalf-of token exchange work, what Forrester says is still unresolved, and which terms remain undisclosed.
Key Takeaways
- On September 2, 2026, Okta announced a set of new Auth0 capabilities. At the center sits AI Identity for Agentic Commerce, built so that a purchase flowing straight out of a conversation with an AI agent can be received and verified by the merchant's own identity layer.
- Technically it comes down to three parts: registering agents up front with CIMD, issuing temporary and narrowly scoped permissions through on-behalf-of token exchange, and securing MCP servers. The design assumes an agent never holds a standing credential.
- Forrester, however, notes that there is still no mature product answer for defining and measuring the risk of agent actions, and that the underlying standards remain unsettled. Pricing and availability in Japan are undisclosed, so for now this is information about design direction rather than a purchase decision.
When an AI agent goes shopping, who is the merchant actually verifying
Auth0 introduces new identity capabilities to help businesses drive growth, secure AI agents, and deliver seamless customer experiences in the agentic era.
www.okta.comSuppose a customer tells ChatGPT to find a pair of hiking boots and just buy them. A few minutes later a purchase request lands on the merchant's server. Two questions have to be answered at that moment. Is there a real human behind this, and did that human genuinely grant permission to spend this amount.
Bradford Peirce, Product Marketing Manager for Retail at Auth0, put those two questions side by side in a post published at the end of August, arguing that most retail systems cannot reliably answer either one. That, in his reading, is why most shoppers who discover products through AI still do not complete the purchase inside the chat, and instead click through to the brand's own site.
The Auth0 capabilities Okta announced on September 2, 2026, bundle the parts needed to answer those two questions into a product. B2C and B2B features shipped together, but the ones that touch agentic commerce directly are on the B2C side.
What was announced, and what each piece takes on
| Capability | Segment | Problem it addresses | Availability at announcement |
|---|---|---|---|
| AI Identity for Agentic Commerce | B2C | Securing a brand's own AI assistants so they can recommend products and support shoppers | Generally available in late September |
| Auth0 Identity Conversion Suite | B2C | Anonymous Sessions before sign-up, plus A/B testing of sign-up and login flows | Beta, early access in late September |
| B2B Connect | B2B | Adding enterprise SSO, federation and multi-tenancy without migrating existing identity infrastructure | Beta, early access in late September |
| Tenancy-as-a-Service | B2B | Self-service tenant configuration and delegated administration | Generally available now |
The headline item is AI Identity for Agentic Commerce. The press release describes it as a set of capabilities that lets businesses secure their own home-grown AI assistants so those assistants can more safely recommend products and support online shoppers. Separately, Auth0 says it enables secure, seamless checkouts when customers buy through third-party AI assistants such as ChatGPT. In other words, the same identity layer is meant to receive both first-party and third-party agents.
Gareth Davies, Chief Product Officer at Auth0, framed the goal as a relationship between revenue and risk.
As AI agents increasingly act and transact on behalf of consumers, the surface area for both business opportunity and vulnerability expands.
On the B2B side, B2B Connect and Tenancy-as-a-Service target SaaS providers onboarding enterprise tenants, with the selling point that enterprise SSO and federation can be layered on without a full migration of users, apps or tokens. That is not a priority for most merchants, but the fact that Auth0 chose to sit on top of existing infrastructure rather than replace it echoes the design thinking on the consumer side too.
CIMD, token exchange and MCP servers
The announcement itself reads close to a list of feature names, but the implementation is legible from material Auth0 published beforehand. For accepting third-party shopping agents, the mechanism has three parts.
The first is agent registration. Using CIMD, which distributes and identifies agent metadata, together with an Agent as Principal model that treats the agent itself as a subject, the merchant decides explicitly which platforms get access. Allow ChatGPT but nothing else, for example. The point is that an agent is not treated as anonymous traffic but registered as a named principal.
The second is on-behalf-of token exchange. Once the shopper approves a cart, the agent receives a temporary, narrowly scoped pass tied to that specific transaction. The agent never holds a master key, and the pass expires quickly. The third is securing MCP servers, which puts authentication and authorization at the door where a merchant opens its catalog and cart operations to outside agents.
None of this foundation is new today. In the Auth0 for AI Agents documentation, the company had already published Token Vault for holding third-party API credentials, an asynchronous human-approval flow built on CIBA, and FGA for constraining what a RAG pipeline may retrieve based on the user's own permissions. Being able to insert human approval where money moves is a structural requirement for agent payments.
Parent company Okta also announced the general availability of Agent SSO on August 24. That one is about agents employees use inside the enterprise, but it points the same way: replacing static API keys and one-off OAuth grants with short-lived tokens. Okta's own research reports that only 34% of organizations apply the same security controls to AI agents as they do to human workers. It is also worth noting that Cross App Access has been formally incorporated as the enterprise-managed authorization extension for MCP.
Where this sits in the protocol race
For the past year, the agent payments conversation has centered on the contest between ACP and UCP. Auth0 declines to bet on either, listing securing UCP servers, supporting AP2, and streamlined identity linking as directions it is working toward. Integration with UCP and ACP is not complete today, and the wording is that work is under way.
What tends to get missed is that these protocols mostly govern how payment and order data are handed over, while the layer underneath, who delegated what to whom, is a separate question. We have covered why passkeys alone do not constitute proof of authorization before: authentication (this is the right person) and authorization (this person may spend this money) are different problems, and what Auth0 is productizing is mainly the latter. The same concern drives parallel work such as Know Your Agent frameworks for verifying the agent's own identity, and the entry of identity platform vendors including Ping Identity and Saviynt. Auth0's move is best read as an approach to that crowded field from the customer identity side.
The numbers, and the analyst caveats
The press release states that AI agents are projected to drive up to 25% of U.S. e-commerce within four years, citing Bain. Read Bain's own piece, though, and the estimate is a range: $300 billion to $500 billion by 2030, or roughly 15% to 25% of overall e-commerce. Okta quotes the top of that range. Bain also notes that most shoppers say they are not yet comfortable letting AI handle an end-to-end transaction.
The more operational caveats come from Forrester. In its Identiverse 2026 recap, the firm characterized agent authentication to MCP servers as the more mature part, handled with OAuth 2.1 and OIDC tokens, while authorization is mid-shift from static RBAC and ABAC policies toward contextual, intent-verified, boundary-constrained decisions. Two of its observations carry the most weight.
First, the financial and reputational risk created by agent actions has no mature product solution for definition or measurement, and organizations are getting by with in-house telemetry. Forrester's examples are concrete: a purchasing agent that scrapes a site and corners inventory by filling carts, one that makes fraudulent purchases, and one that acts in ways its human owner is unhappy with. Scenarios for abusing agents against retailers have been reported from the security vendor side as well.
Second, the standards are immature. Many of the relevant specifications are unfinished or less than twelve months old, commercial support is thin, and Forrester says organizations are largely waiting for them to solidify. The design principle it recommends is delegation, not impersonation: rather than letting an agent pretend to be the human, grant authority to a uniquely identified agent. Auth0's on-behalf-of design points the same way.
What the announcement does not disclose
For anyone weighing adoption, here is what remains undisclosed today.
- Pricing: no pricing model for AI Identity for Agentic Commerce or the other new capabilities appears in the announcement
- Regions: whether availability is limited to particular regions is not stated
- Japan and local support: there is no mention of terms for the Japanese market or of pairing with domestic payment methods
- Protocol timing: integration with UCP, ACP and AP2 is described as work in progress, with no dates
- Production references: no live deployments or metrics for the agentic commerce capabilities themselves are given. The named customer example concerns MFA for loyalty members and SSO setup
The release also carries an explicit disclaimer that features not yet generally available may not be delivered on time or at all, and should not be relied on for purchase decisions. Late September is not a firm date.
In closing
What genuinely moved forward here is that the parts a merchant needs in order to accept agent-driven purchases have been broken into concrete units: agent registration, scoped tokens, and secured MCP servers. That is a step down from abstraction toward something concrete, past the generic goal of making agents safe.
Still unanswered, by products and standards alike, is how to judge whether an authorization was appropriate and how to trace responsibility when a purchase goes wrong. As Forrester puts it, many companies are waiting for the standards to settle.
The work merchants can do now sits upstream of tool selection. Decide whether to open product data to outside agents or keep everything inside a first-party agent, decide which platforms are allowed if you open up, and decide the spending threshold above which human approval is mandatory. With answers to those three, the pricing and specifications that surface after late September can be evaluated against your own conditions.
