ChatGPT Wallet launched 13 November: how US stores accept AI agent payments

Summary. OpenAI launched ChatGPT Wallet on 13 November 2026 and is rolling it out gradually. It lets a dot, OpenAI's always-on agent with its own cloud computer and browser, pay on your existing website. Built with American Express, Mastercard and Visa, it is limited for now to US ChatGPT Pro subscribers aged 18 or over with eligible US-issued cards. The shopper reviews the items, total and card, then approves each purchase with a security check such as Face ID or a fingerprint scan. The card network then issues a payment token with its own card number, security code and expiry date, so your checkout receives a network token, never the real card number. OpenAI says no Wallet-specific integration is needed. The risk sits elsewhere: CDN bot rules can block the dot's cloud browser, and fraud models can decline genuine agent orders. OpenAI's Commerce Partner Playbook covers Web Bot Auth for verified agent traffic, a Forwarded header that relays user signals, and product feeds through Business Hub, and it names Forter, Riskified, Sardine, Signifyd, Adyen, Checkout.com and Stripe as partners. OpenAI charges no fee on purchases made on your site. Our verdict: allow verified ChatGPT agents at the edge and brief your fraud vendor before Thanksgiving on 26 November, 11 days away, and leave plugins until January.

About this article. For ecommerce, payments and fraud leads at merchants selling to US shoppers, including Indian brands with US storefronts. On 15 November 2026 we checked the launch details against OpenAI's announcement, its Commerce Partner Playbook on OpenAI's developer site, its dots and Businesses in ChatGPT announcements and its merchants page, and the comparison and fees against Google's Universal Cart launch post, Google's UCP guide and Stripe's US pricing. OpenAI's main site refused our automated requests, so we read its announcements through Internet Archive copies, dated in the references. OpenAI's help centre article on Wallet would not load in any form, so card-brand details come from Tbreak's report and are labelled as such, as are details Tbreak attributes to CNBC. This is not payment, legal or fraud advice; vendors change terms often, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What OpenAI announced on 13 November 2026

OpenAI calls ChatGPT Wallet the first wallet that lets agents pay without access to the user's actual card details while requiring a security check for every purchase. It says 1.2 billion people use ChatGPT each week, and that it is starting with limited availability to Pro subscribers so it can learn from real use. The table summarises what OpenAI has published in the announcement, the accept-payments guide and its merchants page.

The card-brand row comes from Tbreak, which cites OpenAI's help centre; we could not open that page.

Dots are the reason this matters for merchants. OpenAI introduced them on 29 September 2026 as always-on agents that can work through their own cloud computer, their own browser and the apps a user connects, rolling out across Pro, Business Premium and Enterprise plans. Wallet starts with Pro only. A dot shopping on your site is a cloud browser acting for a customer, so your store sees an automated session that is also a real, approved purchase.

The second change is strategic. OpenAI launched Instant Checkout inside ChatGPT on 29 September 2025, built with Stripe on the Agentic Commerce Protocol. Its merchants page now says it is moving away from a standalone Instant Checkout and prioritising merchant-owned checkout, with purchases completed on the merchant's own website or app. Tbreak, citing CNBC, reports that OpenAI is taking no cut of Wallet transactions at launch. Wallet is the payment layer for that merchant-owned path. Our Black Friday AI traffic checklist noted that ChatGPT sends shoppers to your own checkout; since 13 November an approved agent can also complete it for them. With availability limited to Pro subscribers, expect small volumes this Black Friday and plan for 2027.

How a ChatGPT Wallet purchase reaches your checkout

OpenAI's Partner Playbook describes the journey in four parts: the customer asks, ChatGPT finds options, the customer compares, and the journey moves to browser use or a plugin. For a Wallet purchase on an ordinary store, it runs like this.

1. Discovery. ChatGPT draws on the public web, private API integrations and, for retail, merchant product feeds.

1. Browsing. The dot's cloud browser visits your product pages. Its requests are signed with Web Bot Auth, which uses HTTP Message Signatures (RFC 9421) and carries a Signature-Agent header naming chatgpt.com.

1. Cart and checkout. The dot works through your normal cart and checkout forms, as a shopper would.

1. Approval. The shopper reviews the items, total and card in ChatGPT and approves with a biometric check.

1. Payment. The dot enters the token's card number, security code and expiry in your payment form, and your payment service provider (PSP) authorises it like any card payment. The customer consents only to that transaction.

1. After the sale. You confirm and fulfil the order and handle returns and customer service, as for any customer.

Your systems will see four differences from a human shopper.

ChatGPT Wallet and Google Universal Cart compared

US merchants now face two agent checkouts built in opposite ways. Google began rolling out Universal Cart in the US on 15 October 2026 across Search and the Gemini app, with checkout through Google Pay or a transfer of the items to the merchant's own cart, powered by the Universal Commerce Protocol (UCP). Our Google Universal Cart and UCP guide covers Google's side in detail. The short version, from each company's own pages:

The practical difference: Google asks you to build to its protocol, while OpenAI asks you to stop blocking a browser it already sends. That makes Wallet readiness mostly a configuration job you can finish before Thanksgiving, whereas native UCP checkout is a January project for most stores.

Step 1: Let verified ChatGPT agents through your CDN and bot rules

OpenAI's agent access guide says ChatGPT's cloud browser can already use your site and needs no allowlist, but that security settings may block it by accident. Black Friday is when many retailers tighten bot rules against scalpers, so check this first. OpenAI says Akamai, Cloudflare, HUMAN and Vercel verify ChatGPT's request signatures automatically, and it gives these steps for each.

For any other CDN or web application firewall (WAF), OpenAI says to verify the signature yourself before granting an exception:

1. Confirm the Signature-Agent header matches the value below exactly, quotation marks included.

1. Fetch the public key from OpenAI's key directory, also below.

1. Verify the Signature and Signature-Input headers under RFC 9421.

1. Only then apply the allowlist exception.

            Signature-Agent: "https://chatgpt.com"
Key directory:   https://chatgpt.com/.well-known/http-message-signatures-directory
          

Two points from the same guide shape the decision. First, this is not the crawler: an exception for verified browser visits does not change how you treat OAI-SearchBot, which decides whether you appear in ChatGPT search answers, as our guide to ranking on ChatGPT and AI search explains. Second, the exception applies site-wide, and OpenAI does not yet let site owners control which actions agents take, so keep page-level access controls on account and admin areas.

If your checkout puts a CAPTCHA or a virtual waiting room in front of every session, test it with a verified agent this week. OpenAI's merchant guides do not say how dots handle either.

To see agent sessions in your own logs, record the two headers at the origin. A minimal NGINX example:

            # Log signed ChatGPT agent requests and relayed user signals.
# Logging is not verification: verify signatures at the CDN or WAF.
log_format agentic '$remote_addr [$time_local] "$request" $status '
                   'sig_agent="$http_signature_agent" fwd="$http_forwarded"';
access_log /var/log/nginx/agentic.log agentic;
          

Step 2: Tune fraud and payment rules so agent orders are not declined

This is the step most likely to cost revenue. OpenAI's accept-payments guide says risk systems are often tuned to detect bots from IP addresses and browser details, and that ChatGPT's cloud browser can trip them by accident and make purchases fail. Wallet's tokens work with existing checkout flows; the decline happens in scoring.

OpenAI's fix is the Forwarded HTTP header, which relays signals about the real user: the autonomous system number, the observed IP address, a two-letter IP country, a masked IP prefix, and the user's locale, time zone and browser or app. If you use a third-party risk provider, OpenAI says to confirm your configuration ingests these signals. If you run your own models, start logging the header now; OpenAI warns that the signals may vary while it rolls out support site by site.

In our view, the rules most likely to misfire on a genuine dot purchase are data-centre IP or ASN blocks, device fingerprint and headless-browser checks, IP-to-billing-address distance, and velocity rules keyed on shared cloud IP ranges. OpenAI has not published such a list.

Questions to send your PSP and fraud vendor before 26 November:

1. Do you ingest ChatGPT's Forwarded header signals today, and on which plan?

1. Do you treat Web Bot Auth-verified sessions differently from unverified automation?

1. How does a ChatGPT Wallet network token appear in your dashboard, and do you expose the PAR?

1. How do 3-D Secure or other step-up challenges behave for these transactions? OpenAI's documents do not cover this.

1. Can you route flagged agent orders to manual review rather than auto-decline over Black Friday weekend?

OpenAI names Forter, Riskified, Sardine and Signifyd as fraud prevention partners, and Adyen, Checkout.com and Stripe as payment partners, all working to help their systems recognise legitimate agent purchases. Being on that list does not mean the work is live on your account, so ask.

Two payment rules come straight from OpenAI. You may use Wallet for a subscription if your checkout supports recurring billing, provided you get the customer's consent for recurring charges and follow your processor's practice for merchant-initiated transactions. And you can keep your existing card-on-file flow, because Wallet is a separate payment option, not a replacement.

Step 3: Get your catalogue in front of the dot

Browser access does not require a plugin or product feed, OpenAI says, but a feed improves what ChatGPT finds before the dot reaches your site. On 10 November 2026 OpenAI opened Businesses in ChatGPT in beta, and Business Hub is now the route in. OpenAI's feed guide sets out the sequence: claim your business, verify your identity in the product section, choose the countries and currencies you sell in, then deliver full snapshots by manual upload, a hosted HTTPS URL or SFTP.

The product feed schema has nine required fields (item_id, title, description, url, brand, seller_name, image_url, availability and price) plus the required target_countries and store_country; standard uploads currently target the US. Four details matter for Black Friday:

• Sale prices need feed updates. sale_price must be above zero, strictly below price and in the same currency. OpenAI says to submit the current price and update the feed when a sale starts or ends.

• Price format is strict. Write money as an amount and currency code, such as 79.99 USD, with two decimal places for dollars and no thousands separators.

• Availability is mandatory. An omitted, empty or unrecognised value rejects the row; use unknown explicitly if you do not know.

• Checkout flags are not checkout. is_eligible_checkout only takes effect with a separately enabled checkout integration.

Shopify and Etsy catalogues are already integrated, according to OpenAI's merchants page, and Shopify merchants can also connect their store from Business Hub. Business Hub also reports mentions, website clicks and discovery topics; see our note on ChatGPT Business Hub analytics.

Step 4: Refunds, returns, disputes and recurring charges

OpenAI's documents leave the post-sale work with you.

Disputes cost money. Stripe's US pricing lists a $15.00 fee for each dispute received, plus $15.00 for each dispute you counter manually, returned only if you win. OpenAI says each approval creates a clear record of the purchase the user authorised. It has not said whether merchants can obtain that record as dispute evidence, so keep your own: the verified agent header, the order confirmation and proof of delivery.

Duplicate orders are the other risk when an agent retries a checkout that timed out. Send confirmation emails within seconds and make order creation idempotent, as our flash-sale checkout design guide explains.

Step 5: Measure agent orders separately

Wallet orders will be few at first, so measure them on their own or they will vanish in Black Friday totals. When the CDN verifies the signature, pass a flag such as x-agent-verified: chatgpt to the origin and store it on the order. Then track authorisation, manual-review, cancellation, refund and dispute rates for flagged orders against your human baseline. Do not rely on referral tags to find these sessions; the verified signature is the marker OpenAI documents.

Step 6: Decide whether to block agents

Blocking is a legitimate choice. Tbreak, citing CNBC, reports that United Airlines said it will block agents from booking tickets and that Amazon prevents agents from buying on its platform. OpenAI's counter-argument, in its agent access FAQ, is that sites that block access may lose customers who turn to other sources.

Block deliberately, using the verified identity, if you run limited-quantity drops, sell regulated or age-restricted goods, or cannot yet reconcile token payments. Otherwise allow verified agents and cap order quantity per account. The worst outcome is an accidental block you never notice.

Worked example: a US D2C store over Black Friday weekend

A US apparel brand on Stripe's standard US pricing (2.9% + 30¢ per successful domestic card transaction) expects 200 Wallet purchase attempts from 27 to 30 November at an $85 average order value. The volume is illustrative: OpenAI has not published user numbers. Stripe charges only on successful payments, so the fee per successful order is 2.9% × $85 + $0.30 = $2.465 + $0.30 = $2.765, and the fee total depends on how many orders get through.

The false-decline line dominates. At 15% the store loses $2,550 of sales, about 5.4 times its Stripe fees of $470.05. Cutting the rate to 3% recovers $2,040 of order value ($16,490 minus $14,450) for $66.36 more in fees ($536.41 minus $470.05). The decline rate is the number to watch, not the fee.

Decision table: what to do before 26 November

OpenAI says a plugin lets agents check availability, manage carts or take other actions through your own systems, and that websites can also add WebMCP tools; that work can wait until after the holiday peak.

What is still unconfirmed

• Which retailers Wallet already completes checkout with. OpenAI says some sites may unintentionally block Wallet purchases.

• How chargeback liability, interchange category and 3-D Secure apply to these tokens. Ask your PSP.

• Whether merchants can see OpenAI's authorisation record for disputes.

• When Wallet expands beyond US Pro subscribers. OpenAI gives no date.

• When users can pre-approve purchases within spending limits, categories or time periods, which OpenAI says it expects over time.

• When the Forwarded header reaches every site. OpenAI says support is still rolling out.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our agentic commerce readiness service can review your edge rules, checkout and fraud configuration for agent purchases and test a full ChatGPT Wallet checkout before Black Friday. Talk to us at /contact-us/.

Last updated: 15 November 2026.

References

1. Introducing ChatGPT Wallet, 13 November 2026 (archived copy, 13 November 2026) — OpenAI

1. Introducing dots, 29 September 2026 (archived copy, 12 November 2026) — OpenAI

1. Accept payments — OpenAI Developers

1. Help ensure cloud browser access to your site — OpenAI Developers

1. Power product discovery in ChatGPT — OpenAI

1. ChatGPT Wallet: dots agents can shop without your card, 13 November 2026 — Tbreak

1. Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol, 29 September 2025 (archived copy, 9 November 2026) — OpenAI

1. Partner Playbook Overview — OpenAI Developers

1. Google's new Universal Cart launches today in the U.S., 15 October 2026 — Google

1. Google Universal Commerce Protocol (UCP) Guide — Google for Developers

1. RFC 9421: HTTP Message Signatures, February 2024 — IETF

1. Overview of OpenAI Crawlers — OpenAI Developers

1. Submit product feeds — OpenAI Developers

1. Introducing Businesses in ChatGPT, 10 November 2026 (archived copy, 13 November 2026) — OpenAI

1. Product feed schema — OpenAI Developers

1. Pricing and fees, United States (archived copy, 7 November 2026) — Stripe

1. Build a plugin — OpenAI Developers