xpay✦

Your next customer is asking ChatGPT, not Google. They’re shopping by typing “find me a cordless drill under $80 that ships in 2 days” into a chat box — and quietly walking away from any store the AI can’t see. Right now, that’s most WooCommerce stores.
Agentic Commerce for WooCommerce (by xpay) makes your store visible to ChatGPT, Claude, Gemini and Perplexity in five minutes flat — no theme changes, no replatforming, no new payment processor. Your existing checkout stays exactly as it is; xpay just makes sure you’re the answer the AI gives.
📘 Full setup guide with screenshots: <a href="https://docs.xpay.sh/merchants/woocommerce" rel="nofollow ugc">docs.xpay.sh/merchants/woocommerce</a> 
🌐 Plugin home: <a href="https://www.xpay.sh/merchants/woocommerce/" rel="nofollow ugc">www.xpay.sh/merchants/woocommerce/</a> 
🔓 Source on GitHub: <a href="https://github.com/xpaysh/agentic-commerce-for-woocommerce" rel="nofollow ugc">github.com/xpaysh/agentic-commerce-for-woocommerce</a>
<h4>What it does</h4>
<ul>
<li>Publishes a public, agent-readable product feed — your full catalog with live prices and stock, hosted on xpay’s CDN (no extra load on your origin).</li>
<li>Adds AI-shopping JSON-LD — <code>Product</code>, <code>Offer</code>, <code>AggregateOffer</code>, <code>BuyAction</code> and <code>ItemList</code> schemas on product pages, shop archive and home page. Detects existing schema from Yoast / Rank Math / WooCommerce core and only fills the gaps.</li>
<li>Serves the real AI shopping standards on your own domain — <code>/llms.txt</code> (<a href="https://llmstxt.org" rel="nofollow ugc">llmstxt.org</a>), <code>schema.org</code> <code>Product</code>/<code>Offer</code>/<code>BuyAction</code> JSON-LD on every product page, and an explicit <code>robots.txt</code> allowlist for AI user-agents. Optional watchlist emitters for <code>/.well-known/oauth-protected-resource</code> (RFC 9728, when UCP OAuth identity linking is on) and <code>/.well-known/agent-card.json</code> (A2A 1.0, off by default). The discovery layer is registry-based so new standards plug in cleanly.</li>
<li>Allows the right bots — GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Google-Extended, Applebot-Extended and CCBot. Never overrides your existing robots.txt rules.</li>
<li>Cart deep-link — AI agents create a one-click “Buy” link that pre-fills your existing WooCommerce cart and lands the buyer on your existing checkout. Orders are tagged with <code>_xpay_agent_attribution</code> so you can attribute AI-driven revenue in your existing reporting.</li>
<li>Live inventory — webhook-driven catalog refresh on every product / stock change (debounced 30s), plus an hourly safety-net poll.</li>
</ul>
<h4>What it doesn’t do</h4>
<ul>
<li>It doesn’t touch your checkout. Stripe / WooPayments / PayPal / Square / whatever you already use — payment runs through them, unchanged. Your payout schedule is unchanged.</li>
<li>It doesn’t see your customers. No buyer names, emails, addresses, IPs, payment cards, order line items, refunds, or PII of any kind passes through xpay. Ever. The plugin is non-custodial.</li>
<li>It doesn’t require a new account or contract to start. Free until your first AI-attributable sale; pricing kicks in after that. <a href="https://www.xpay.sh/pricing/?tab=agentic-commerce" rel="nofollow ugc">See pricing</a>.</li>
<li>It doesn’t slow down your site. The JSON-LD block is tiny and cached; the catalog feed is served from xpay’s CDN, not your origin.</li>
</ul>
<h4>Five-minute install flow</h4>
<ol>
<li>Install the plugin from this directory or upload the zip. (<a href="https://docs.xpay.sh/merchants/woocommerce/installing" rel="nofollow ugc">detailed walk-through</a>)</li>
<li>Activate. You’ll be taken to Settings → xpay.</li>
<li>Click Connect store. You’re redirected to app.xpay.sh, where you grant a read-only WooCommerce REST API key. (<a href="https://docs.xpay.sh/merchants/woocommerce/rest-api-keys" rel="nofollow ugc">how to generate one</a>)</li>
<li>Your catalog goes live on AI surfaces within about 10 minutes. The plugin’s built-in audit-readiness checklist (<a href="https://docs.xpay.sh/merchants/woocommerce/audit-readiness" rel="nofollow ugc">what each row means</a>) turns green as each piece confirms.</li>
</ol>
Stuck on any step? <a href="https://docs.xpay.sh/merchants/woocommerce/troubleshooting" rel="nofollow ugc">Troubleshooting guide</a>.
<h4>Compatibility</h4>
<ul>
<li>WooCommerce 7.0+ on WordPress 6.2+ and PHP 7.4+.</li>
<li>Declares compatibility with WooCommerce High-Performance Order Storage (HPOS) and Cart/Checkout Blocks.</li>
<li>Works alongside Yoast SEO, Rank Math, WooCommerce Blocks, WooPayments, Stripe for WooCommerce, and the standard Storefront / Astra / Divi / Elementor themes.</li>
</ul>
<h4>Privacy and consent</h4>
<ul>
<li>Anonymous lifecycle telemetry is off by default. On first activation a single admin notice asks once. Pick “No thanks” and the plugin never contacts our backend for analytics. Pick “Enable” and you can change your mind any time under Settings → xpay → Privacy. System-wide opt-out via <code>define( 'XPAY_WC_TELEMETRY', false );</code> in <code>wp-config.php</code>.</li>
<li>Full data disclosure at <a href="https://install.xpay.sh/woocommerce/privacy.html" rel="nofollow ugc">install.xpay.sh/woocommerce/privacy.html</a> — every byte the plugin sends, when it sends it, how to opt out, how to request deletion. Plain-English version: <a href="https://docs.xpay.sh/merchants/woocommerce/privacy-telemetry" rel="nofollow ugc">docs.xpay.sh/merchants/woocommerce/privacy-telemetry</a>.</li>
</ul>
<h4>Source code and contributing</h4>
The plugin source is published under GPLv2-or-later. Public repo and issue tracker: <a href="https://github.com/xpaysh/agentic-commerce-for-woocommerce" rel="nofollow ugc">github.com/xpaysh/agentic-commerce-for-woocommerce</a>. You can fork, modify, redistribute, and self-host without paying anything.
<h3>External services</h3>
This plugin connects to the following xpay-operated services to deliver its core function. Every endpoint and its purpose is documented; full payload disclosure is in the <a href="https://install.xpay.sh/woocommerce/privacy.html" rel="nofollow ugc">Privacy</a> section.
<ol>
<li>
agent-feed.xpay.sh — Public CDN that hosts your AI-readable catalog feed at <code>https://agent-feed.xpay.sh/catalog/{your-slug}.json</code>. The plugin does not contact this URL directly; the xpay backend writes it from your WooCommerce REST API after you click Connect store.
</li>
<li>
agent-commerce.xpay.sh — The agent-side API that AI shopping agents call to surface and buy from your products. The plugin contacts this host at the following paths: (a) <code>POST /v1/onboard/woocommerce/wc-auth-callback</code> is the WooCommerce OAuth callback target (WordPress itself calls this on your behalf, server-to-server, after you approve the one-click connect prompt); (b) <code>GET /v1/onboard/woocommerce/status?nonce=…</code> is polled by the xpay onboarding page while the handshake finishes; (c) <code>POST /v1/merchants/{slug}/resync</code> triggers a fresh catalog ingest after a product or stock change; (d) <code>GET /v1/merchants/{slug}</code> is called when Settings → xpay verifies the current connection state; (e) <code>PATCH /v1/merchants/{slug}/products/{sku}</code> pushes a single-product delta when a WooCommerce product/stock webhook fires; (f) <code>DELETE /v1/merchants/{slug}</code> is sent (non-blocking) when you click Disconnect so xpay marks your account as disconnected and archives the cached catalog. The hostname is also the publicly advertised target for <code>POST /mcp/{slug}</code> (the JSON-RPC commerce MCP endpoint AI agents talk to) — the plugin itself does not call this URL but lists it in the <code>/.well-known/ucp</code> manifest.
</li>
<li>
app.xpay.sh/onboard/woocommerce — The merchant-side onboarding page. When you click Connect store, the plugin redirects your browser here with three query-string parameters: your site URL, your administrator email address, and a one-time random nonce generated locally. No data is sent to xpay before you click the button. You sign in or sign up on xpay and grant the WooCommerce REST API permission there.
</li>
<li>
agent-commerce.xpay.sh/v1/events — Optional anonymous lifecycle telemetry. Disabled by default; only contacted if you explicitly opt in via the first-activation admin notice or Settings → xpay → Privacy. Full payload disclosure in the Privacy section.
</li>
<li>
agent-commerce.xpay.sh/v1/agent-analytics — Optional anonymous AI-bot crawl analytics. Disabled by default; shares the same opt-in as item 4 (and respects a separate <code>define( 'XPAY_WC_AGENT_ANALYTICS', false )</code> hard-off). When enabled, the plugin counts requests from known AI bots only (e.g. GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended) — recording the bot name, a coarse page type (home/product/category/discovery-file/sitemap/other), the HTTP status, and whether we routed the bot to your structured catalog. It also sends an aggregate daily count of human pageviews (a number only — no user-agent, no URLs, no per-visit data) as the AI-vs-human denominator. Events are buffered locally and sent in the background by WP-Cron, never on a page load. Cart, checkout, account, admin and REST paths are never recorded. No per-visit human data, no IP addresses, no customer, order, or personal data.
</li>
<li>
audit.xpay.sh — Merchant-facing audit dashboard. The plugin emits a link to <code>audit.xpay.sh/{your-slug}</code> on the Settings page so you can review the live agent-readiness score xpay computed from your catalog; the plugin itself does not fetch from this host. Opening the link from your browser sends standard browser headers to xpay.
</li>
<li>auth.xpay.sh — Public OAuth-protected-resource discovery target. The plugin publishes <code>auth.xpay.sh</code> as the <code>authorization_servers[0]</code> entry in <code>/.well-known/oauth-protected-resource</code> (an RFC 9728 metadata document AI agents fetch to learn where to obtain a token). The plugin does not contact this host server-to-server; it is referenced for agent-side discovery only.</li>
<li>install.xpay.sh/woocommerce/{terms,privacy}.html — Static legal documents linked from this readme and from the Settings privacy panel. The plugin itself does not fetch these URLs; clicking the links opens them in your browser.</li>
</ol>
Terms of use: <a href="https://install.xpay.sh/woocommerce/terms.html" rel="nofollow ugc">install.xpay.sh/woocommerce/terms.html</a> 
Privacy policy: <a href="https://install.xpay.sh/woocommerce/privacy.html" rel="nofollow ugc">install.xpay.sh/woocommerce/privacy.html</a>
<h3>Privacy</h3>
xpay is built non-custodially: we never see your customers, your orders, or any payment data. Concretely:
<ul>
<li>
Nothing leaves your site before you click Connect store. The Settings → xpay page is pure markup — no outbound HTTP, no analytics ping, no nonce pre-registration.
</li>
<li>
Sent only after you click Connect store (required for the plugin to work): your site URL, your administrator email address, a one-time random nonce, your WooCommerce REST API consumer key/secret (so xpay can read the product catalog), and your public product fields (name, description, price, stock, image URLs, categories). No customer data. No order data. No payment data.
</li>
<li>
Optionally sent if you opt in to anonymous telemetry (default OFF): lifecycle event names tagged with your site URL, plugin version, WP version, WC version, PHP version, locale. No customer data, no order data, no customer PII.
</li>
<li>
Optionally sent if you opt in (default OFF), as part of the same telemetry consent — AI-bot crawl analytics: for requests from known AI bots only, the bot name, a coarse page type (home/product/category/discovery-file/sitemap/other), the HTTP status, and whether the bot was routed to your structured catalog — tagged with your site URL. Also sent: an aggregate daily count of human pageviews (a number only — the AI-vs-human denominator). Never recorded: per-visit human data, IP addresses, query strings, cart/checkout/account/admin/REST paths, or any customer, order, or personal data. Hard-disable just this (while keeping lifecycle telemetry) with <code>define( 'XPAY_WC_AGENT_ANALYTICS', false );</code>.
</li>
<li>
Opt out of anonymous telemetry: Settings → xpay → Privacy → Turn off. Or define <code>XPAY_WC_TELEMETRY</code> to <code>false</code> in <code>wp-config.php</code> for a system-wide hard disable that overrides any UI choice.
</li>
<li>
Request data deletion: email privacy@xpay.sh from your admin email with your merchant slug. We process within 7 business days.
</li>
</ul>
Full data-handling disclosure: <a href="https://install.xpay.sh/woocommerce/privacy.html" rel="nofollow ugc">install.xpay.sh/woocommerce/privacy.html</a>.

Agentic Commerce for WooCommerce

Put your WooCommerce catalog inside ChatGPT, Claude, Gemini and Perplexity — buyers complete checkout on your existing WooCommerce gateway.

Michel Jongbloed

AukeJomm

WPMR Agentic Checkout for WooCommerce enables any WooCommerce store to participate in “Buy it in ChatGPT” — OpenAI’s revolutionary feature that lets over 700 million weekly ChatGPT users discover and purchase products directly within their conversations.
This plugin implements the Agentic Commerce Protocol (ACP) — the open standard co-developed by OpenAI and Stripe that powers AI-driven commerce.
Developed by WP Marketing Robot to help WooCommerce store owners tap into the future of AI-powered commerce.
<h4>How It Works</h4>
Agentic Checkout for WooCommerce works together with <a href="https://www.wpmarketingrobot.com/downloads/wp-product-feed-manager/" rel="nofollow ugc">WP Product Feed Manager for WooCommerce</a> — the Multi Channel product feed manager for WooCommerce:
<ol>
<li>WP Product Feed Manager generates a ChatGPT-optimized product feed for OpenAI to index</li>
<li>WPMR Agentic Checkout handles all checkout communication between ChatGPT and your store</li>
</ol>
When a ChatGPT user decides to buy one of your products:
<ol>
<li>Discovery — Your products are indexed from your WooCommerce site (via WP Product Feed Manager)</li>
<li>Buy Click — User clicks “Buy” in ChatGPT (your site must be approved/enabled by OpenAI)</li>
<li>Instant Checkout — Payment is confirmed in ChatGPT via Stripe (PCI-compliant)</li>
<li>Order Handoff — ChatGPT sends the order via Agentic Commerce Protocol</li>
<li>Plugin Validation — This plugin receives the order, validates inventory and shipping address</li>
<li>Accept/Decline — Plugin confirms or rejects the order to ChatGPT in real-time</li>
<li>Order Creation — If accepted, the order is created in WooCommerce as paid (status: Processing)</li>
<li>Fulfillment — You ship the product and provide customer support as normal</li>
</ol>
<h4>Key Features</h4>
Checkout & Communication
<ul>
<li>ACP REST API Endpoints — Full implementation of checkout session create, update, complete, and cancel endpoints</li>
<li>Request Validation — Signature verification, IP allowlisting, and idempotency handling per OpenAI spec</li>
<li>Webhook Notifications — Sends order_created and order_updated events to OpenAI</li>
</ul>
Payment Processing
<ul>
<li>Stripe Integration — Secure payment processing using Stripe’s delegated payment tokens</li>
<li>PCI Compliant — Plugin never touches raw card data; all sensitive data handled by Stripe</li>
<li>3D Secure Support — Handles authentication challenges when required</li>
</ul>
WooCommerce Integration
<ul>
<li>Native Orders — Orders flow through standard WooCommerce workflow</li>
<li>Tax Calculation — Uses WooCommerce tax settings based on shipping address</li>
<li>Shipping Zones — Integrates with WooCommerce shipping zones and methods</li>
<li>Inventory Sync — Stock availability checked in real-time</li>
</ul>
Admin Features
<ul>
<li>Per-Product Control — Enable/disable individual products for ChatGPT checkout</li>
<li>Bulk Actions — Manage multiple products at once from the product list</li>
<li>Test Mode — Safely test your integration before going live</li>
<li>Activity Logging — Track all API requests and webhook deliveries</li>
<li>robots.txt Helper — Built-in instructions for configuring OpenAI crawlers</li>
</ul>
<h4>About the Agentic Commerce Protocol</h4>
ACP is an open standard that defines how AI agents communicate with e-commerce platforms. It enables:
<ul>
<li>Browsing product catalogs</li>
<li>Creating and managing checkout sessions</li>
<li>Processing payments securely</li>
<li>Handling fulfillment and shipping</li>
</ul>
Think of ACP as the language that allows AI and e-commerce to speak to each other.
<h4>Why WPMR Agentic Checkout?</h4>
<ul>
<li>New Sales Channel — Reach 700M+ weekly ChatGPT users</li>
<li>You Stay in Control — Remain the merchant of record for orders, payments, and support</li>
<li>Leverage Existing Data — Works with your WP Product Feed Manager product feed</li>
<li>Free & Open Source — GPL-licensed, no fees from the plugin itself</li>
</ul>
<h3>Configuration</h3>
After installation:
<ol>
<li>Apply for ACP approval at https://openai.com/index/buy-it-in-chatgpt/</li>
<li>Once approved, obtain your OpenAI API Key from the OpenAI ACP dashboard</li>
<li>Get your Stripe API keys from https://dashboard.stripe.com/apikeys</li>
<li>Enter all API keys in the plugin settings page</li>
<li>Build your ChatGPT product feed in Product Feed Manager plugin </li>
<li>Submit your product feed URL to OpenAI for indexing</li>
</ol>
<h3>External Services</h3>
This plugin relies on third-party services to provide ACP checkout, payment processing, security validation, and connection testing.
<h4>OpenAI</h4>
OpenAI is used to support “Buy it in ChatGPT” / Agentic Commerce Protocol functionality.
Data sent and when: 
– During admin connection tests, the plugin sends your configured OpenAI API key (as an Authorization header) to OpenAI’s models endpoint to verify API access. 
– During IP allowlisting updates, the plugin fetches OpenAI’s published CIDR list from <code>https://openai.com/chatgpt-connectors.json</code> to validate incoming ACP requests. 
– During normal operation, order and fulfillment webhook payloads required by ACP are sent to OpenAI when ChatGPT-originated orders are created or updated.
OpenAI legal links: 
– Terms of Use: https://openai.com/policies/terms-of-use/ 
– Privacy Policy: https://openai.com/policies/privacy-policy/
<h4>Stripe</h4>
Stripe is used to process payments for ChatGPT checkout orders.
Data sent and when: 
– During admin connection tests, the plugin sends your Stripe secret key (as a Basic Authorization header) to Stripe’s account endpoint to verify account/API connectivity. 
– During checkout processing, payment-related request data is sent to Stripe to create/confirm payment intents and complete payment flows.
Stripe legal links: 
– Services Agreement / Terms: https://stripe.com/legal/ssa 
– Privacy Policy: https://stripe.com/privacy
<h3>About WP Marketing Robot</h3>
WP Marketing Robot specializes in innovative e-commerce and marketing solutions for WordPress and WooCommerce. We create tools that help online store owners succeed in the evolving digital commerce landscape.
Website: https://wpmarketingrobot.com

WPMR Agentic Checkout for WooCommerce

Enable "Buy in ChatGPT" for WooCommerce. Let customers buy products through ChatGPT conversations using OpenAI's Agentic Commerce Protocol.

Agentic Commerce for WooCommerce vs WPMR Agentic Checkout for WooCommerce