Shop Pay Now Works at Brands Off Shopify: Fall '26 Edition Extends Agent Checkout in Claude Duet, Grok Bot, and More with Visa and Mastercard Tokens
With the Fall '26 Edition, Shop Pay arrived in Muse, Claude Duet, Grok Bot, and Instinct, and now works at brands not on Shopify. How tokens keep cards away from agents, how this differs from Stripe's approach, the Google AI Mode conditions, merchant controls, and what has not been disclosed.
Key Takeaways
- In its Fall '26 Edition on October 28, 2026 (U.S. time), Shopify made Shop Pay available inside personal agents such as Meta's Muse, Claude Duet, Grok Bot, and Instinct, and in Claude Duet, Grok Bot, and Instinct shoppers can now pay with Shop Pay even at brands that do not run on Shopify
- The system relies on agent tokens from Mastercard, Visa, and Discover (American Express is coming soon), so the agent never sees the shopper's card number. This is the opposite of the Stripe-style approach of inserting a single-use virtual card, and the card networks are backing it
- The Edition also added direct checkout in Google AI Mode and Gemini, a way to pass compare-at prices to agents, and a "Knowledge base" where merchants approve the facts agents receive. The fees for merchants off Shopify and how responsibility is split in disputes have not been disclosed
Shop Pay steps outside Shopify
Shopify's Fall '26 Edition for merchants
www.shopify.comThe fall installment of Editions, the product showcase Shopify holds twice a year, was published on October 28, 2026 (U.S. time). Its theme is "Exponential," and the merchant announcement shows that most of the items relate to agentic commerce, in which AI agents search for products and complete purchases on a shopper's behalf.
From a payments perspective, the weightiest item is "Shop Pay in personal AI agents." Shop Pay is Shopify's one-click checkout, and Shopify says more than 400 million people already trust it. Shop Pay can now be used at checkout inside Meta's "Muse," Claude Duet, Grok Bot, and Instinct.
The next sentence goes further. The full Edition page explains that through Claude Duet, Grok Bot, and Instinct, shoppers can buy from any brand with Shop Pay, whether or not it is on Shopify. Until now, Shop Pay was essentially a payment method used in Shopify stores.
If the shop.md skill released in mid-October widened the doorway through which agents buy Shopify products, this time the story is that Shop Pay itself has become a wallet that works outside Shopify.
Keeping the card away from the agent
Handing a card number to an AI agent feels risky. Shopify is trying to answer that instinct with system design. The merchant announcement says Shop Pay's security model carries over to agents: the buyer stays in control of purchases, and the card is never shared with the agent. Purchases from merchants off Shopify are protected by tokens from Mastercard, Visa, and Discover, with American Express coming soon.
Rohit Mishra, Shopify's VP of Product, put it this way in a post on X (quoted by PYMNTS).
The agent never sees the buyer's card.
The specific flow is described on Shop's help page. When buying from a store that does not offer Shop Pay, the shopper approves the store, purchase details, payment method, and spending limit in Shop. The agent then receives a one-time payment credential to enter at the store's checkout. The saved payment method details are shared with neither the agent nor the store.
In these cases, Shop may pay the store on the shopper's behalf and then charge the shopper's selected payment method for the approved amount. The statement shows a descriptor such as "SHOPPAY*[store name]." The store remains responsible for fulfillment, returns, refunds, and warranties.
Another point not to miss is a setting that skips approval for each purchase. If the shopper turns on "Allow agent to pay for me" in the Shop app and sets a weekly, monthly, or total budget, the agent can buy within that range without approval. The payment first tries the last-used card in the Shop wallet, then other saved valid cards if that fails.
The help page attaches a serious caveat here. Purchases made within the permissions and budget are the shopper's responsibility even if the agent misunderstands instructions, and a dispute may not succeed.
Tokens or single-use cards
The announcement drew attention in the payments industry because of the method Shopify chose. According to The Information's report, cited by PYMNTS, Shopify's choice runs counter to Stripe's approach. Stripe issues single-use virtual cards for agents connected to the cardholder's account. The report says this approach has raised concern among card networks, because it can reduce their visibility into the shopping and payment process and make it harder to link the user to the actual purchase.
A network token is a substitute number used in place of the card number. Because the transaction stays linked to the original card, rewards, protections, and the issuer's fraud detection still apply. That is what Mishra meant when he wrote that buyers keep the rewards and protection they expect.
The next day, October 29, Mastercard offered something like confirmation. According to PYMNTS, CEO Michael Miebach said on the third-quarter earnings call that Shopify's Shop Pay uses Mastercard Agent Pay and Mastercard network tokens to preserve consumers' credentials throughout the payment. Agent Pay combines tokenization with verification of the agent's authority.
On the same call, Miebach described inserting a single-use virtual card (VCN) as a "bridge" to full tokenization (American Banker reported the same point).
that's not a long-term solution that we will supportSource: Michael Miebach, Mastercard CEO
The picture is not that simple, however. Shop's own help page says that for some purchases, such as from stores without Shop Pay, Shop might use a limited-use payment credential, such as a token or one-time virtual card, instead of the underlying payment details. In other words, Shopify also leaves room to use single-use cards depending on the merchant. The announcement does not reveal which purchases use tokens and which use virtual cards.
There is a caveat on cost as well. Mastercard CFO Ling Hai identified additional token functionality for agents as an area for development and pricing. If token-based payments spread, the networks may put a price on those added functions. Demand still faces a hurdle too. A PYMNTS Intelligence study cited by PYMNTS found that 56% of shoppers would let an agent search and compare products for them, but only 35% would give an agent access to their saved payment credentials.
Checkout in Google AI Mode and Gemini too
The Edition also added the ability to sell in Google's AI Mode and the Gemini app with checkout powered by Shopify. Shoppers finish the purchase in the conversation, and merchants handle orders in the usual admin.
Shopify's help center lays out fairly specific conditions.
| Item | Details |
|---|---|
| Who you sell to | Shoppers in the United States, Canada, and Australia (your store can be based anywhere). Direct checkout is rolling out gradually in these three countries |
| Prerequisites | A valid Google Merchant Center account, eligibility for Shopify Catalog, and completed terms of service, privacy, and return and refund policies |
| Default | Direct checkout is on once the store is eligible. If turned off, buyers are sent to your online store to complete the purchase |
| Fees | No selling fees. Only standard payment processing fees |
| Not supported | Subscription-only products, bundles, customizable products, B2B-only products, pickup in store, and local delivery |
| Tracking | Google Analytics and custom pixels do not fire; only server-to-server pixels (started, completed) |
For Japanese merchants, the key point is that sales are limited to shoppers in the United States, Canada, and Australia. Because the store's own country does not matter, cross-border sellers that ship to these three countries may qualify. Since the feature is on by default, it is worth understanding in advance the tracking gap caused by Google Analytics not firing.
More controls in merchants' hands
Merchants selling to agents gained three tools. The first is compare-at pricing. In channel mapping for Shopify Catalog (the catalog through which Shopify passes product data to agents), merchants can choose "Price" or "Compare-at price" as the list price. With the latter, the compare-at price reaches agents only when it is higher than the current price, and agents can show it as strikethrough pricing. It addresses the problem of sale information dropping out of AI answers.
The second, worth a closer look, is the Knowledge base. It is where non-product facts about the store, such as return windows, shipping destinations, and gift services, are passed to agents, and it sits at Sales channels > Agentic in the admin. Shopify drafts facts from the public storefront and suggests updates, but facts generated by a scan do not reach agents until the merchant publishes them.
There are exceptions. Facts linked to the admin, such as store policies and contact details, are published when they are created. Published content also becomes public information that outside AI can read through the Storefront MCP. The knowledge base holds up to 1,000 facts in total.
The third concerns physical stores. According to the Edition page, AI agents can now discover a merchant's retail locations and direct shoppers to the nearest store. For developers, this is offered as location search through the Universal Commerce Protocol (UCP).
The developer announcement added shop.dev, a single connection to Catalog, cart, checkout, and Shop Pay that developers can start using with no key required (eCommerceNews Australia described it as "Shop MCP").
What merchants should check now
Merchants on Shopify can start by checking in the admin whether their store is eligible for Shopify Catalog, then reading the Knowledge base drafts and deciding what to publish. The more a store sells non-returnable items, the more its policy wording directly shapes agent decisions. Shop's help page even suggests shoppers tell their agent not to buy from stores that don't accept returns.
Merchants not on Shopify are affected too, since orders via Claude Duet or Instinct may arrive as ordinary card payments. When transactions paid by Shop mix in, the assumptions behind fraud screening and customer inquiries change.
Even after reading the announcement and help pages, the following have not been disclosed.
- Shop Pay fees for merchants off Shopify, and whether merchants bear any cost
- How responsibility is split among Shop, the agent, and the merchant when a chargeback occurs on an agent purchase
- The conditions for choosing between tokens and one-time virtual cards
- When American Express support will begin
- Which countries and regions Shop Pay checkout in personal agents covers
Summary
With the Fall '26 Edition, Shop Pay expanded from "the checkout used in Shopify stores" to "a wallet agents carry with them." The design of never handing card numbers to agents and connecting through card network tokens matches the networks' own interests closely enough that Mastercard's CEO cited it on an earnings call.
At the same time, Shop leaves room to use virtual cards, and for purchases without approval it places the risk of mistaken purchases on the shopper. Whether agent transactions really grow during the holiday season, and when fees and dispute handling become clear, are the next things to watch.
