OpenAI launches ChatGPT Wallet and a merchant playbook for agent checkout

OpenAI launched ChatGPT Wallet on 13 November 2026, a payment method that lets a ChatGPT agent pay on a website for its user without ever holding the real card number. On the same day it published a Commerce Partner Playbook that tells merchants what to check on their own side: product feeds, agent access through the CDN or firewall, payments, risk systems and the Business Hub profile. The wallet itself is narrow at launch. According to OpenAI's announcement, it is rolling out only inside dots, OpenAI's always-on agents, for ChatGPT Pro subscribers aged 18 or older in the United States who hold eligible US-issued cards. The merchant checklist applies more widely, and most of the work is there.

What OpenAI announced on 13 November 2026

OpenAI published two things on 13 November 2026. The first is ChatGPT Wallet, built with American Express, Mastercard and Visa. The second is the Commerce Partner Playbook on OpenAI's developer site, a set of six guides for businesses that want purchases and bookings started in ChatGPT to complete on their websites.

OpenAI says 1.2 billion people use ChatGPT each week and that many of them use it to research and compare products. That figure describes ChatGPT as a whole. It is not the number of people who can pay with the wallet, which is limited to one subscription tier in one country.

The announcement puts a clear condition on merchants. In OpenAI's words, websites need to make sure agents are "not inadvertently blocked", and payment and risk systems need to recognise legitimate purchases made by agents. A wallet payment only succeeds if the agent can reach the checkout page and the fraud system does not reject the order.

How a ChatGPT Wallet purchase works

OpenAI's description of a Wallet purchase, as published on 13 November 2026, runs in this order:

• The user adds a card to ChatGPT Wallet once.
• Before each purchase, the user reviews the items, the total and the selected card.
• The user approves with a security check such as Face ID or a fingerprint scan.
• The card network then issues a payment token: a substitute card number, security code and expiry date.
• The payment is charged to the card the user selected. Neither the business nor the agent receives the actual card details.

OpenAI says users keep their card rewards and their protections for eligible disputes. The business keeps the customer relationship and stays in charge of pricing, fulfilment, returns and customer service. Under that description, the shopper still buys from the merchant, on the merchant's site. OpenAI supplies the agent and the wallet.

OpenAI also says it expects, over time, to let users hand purchases over to an agent entirely, within limits such as a spending cap, a set of categories or a time period. The announcement gives no date for that.

Who can use ChatGPT Wallet today

ChatGPT Wallet is available only in the United States at launch. OpenAI's 13 November 2026 announcement lists four conditions: the user must be a ChatGPT Pro subscriber, aged 18 or older, in the US, with an eligible US-issued card. Purchases run inside dots.

The announcement does not name any other country, and it gives no timetable for expansion. Thailand is not mentioned. A Thai shopper cannot pay with ChatGPT Wallet today, and nothing OpenAI has published says when that will change.

The Commerce Partner Playbook: what merchants are asked to do

The Commerce Partner Playbook on OpenAI's developer site lists six steps: submit product feeds (for businesses that sell physical goods), check that the cloud browser can reach the site, accept payments, build a plugin, integrate Sign in with ChatGPT, and claim the business in Business Hub. OpenAI describes two routes once a customer has chosen something to buy. Browser use follows the merchant's existing website flow and, by OpenAI's account, needs little engineering. A plugin takes more integration work and gives the business structured actions and more control over how its backend validates them.

The table below summarises the five areas of the playbook that matter most to a marketing or e-commerce team, with what OpenAI's documentation says about each.

Agent access: Web Bot Auth and the CDN or firewall

One practical job in the playbook is to find out whether the site turns ChatGPT's agent away. OpenAI's agent access guide says ChatGPT's cloud browser can already use a website and does not need to be added to an allowlist. The problem it describes is accidental: a site's security settings may unintentionally block these visits.

OpenAI's fix is to allow verified visits and leave every other control as it is. ChatGPT signs certain automated browser requests with Web Bot Auth, which uses the HTTP Message Signatures standard, RFC 9421. A signed request carries a Signature header, a Signature-Input header and a Signature-Agent header set to "https://chatgpt.com". OpenAI publishes the public keys so that a CDN, firewall or edge service can validate the signature.

According to the guide, Akamai, Cloudflare, HUMAN and Vercel verify these signatures automatically, and it gives step-by-step settings for each. Sites on other providers are told to verify the signature themselves before applying an exception.

Read two details in the guide before changing a rule. First, the guidance covers signed cloud browser requests, not crawlers. OpenAI states that these visits are separate from its web crawlers, including OAI-SearchBot, so an allow rule for the agent does not change how a site handles crawling. Second, the exception can apply site-wide, so OpenAI tells site owners to keep their existing page-level access controls.

The guide also says OpenAI does not yet offer site owners a way to control which actions a user's agent may take, but that it requires human review before any consequential action across all users.

Payments: a network token arrives at the existing checkout

OpenAI's accept payments guide says ChatGPT Wallet "works out of the box with existing checkout pages" and payment forms. The other payment guidance and the browser access checks are described as optional steps that help Wallet run smoothly.

The guide answers four questions a payments team will ask:

• The merchant does not receive the full card number. It receives a network token, and can use the Payment Account Reference (PAR) to associate that token with the underlying payment account.
• The credential covers one transaction. The customer consents only to that specific purchase, and OpenAI tells merchants not to reuse or save the credential for another one.
• Subscriptions are possible if the existing checkout supports recurring billing. OpenAI tells merchants to get the customer's consent for recurring charges and follow their processor's practices for merchant-initiated transactions.
• A card already saved with the business keeps working. OpenAI describes Wallet as a separate payment option alongside an existing card-on-file flow.

The business handles the order, fulfilment, customer support and fraud decisions. OpenAI's documentation does not state a fee for accepting a Wallet payment.

Risk systems: the Forwarded header

OpenAI's payments guide explains why an approved purchase can still fail. Risk systems are often tuned to detect bots and rely on signals such as the IP address or details of the connected browser. A purchase made through ChatGPT's cloud browser can trip those systems by accident.

OpenAI's answer is to relay signals about the real user through the Forwarded HTTP header, which it says it is rolling out. The guide lists seven parameters that may appear: asn, for, ip-country, ip-prefix, locale, tz and user-agent. They cover the user's observed IP address and network, an estimated two-letter country code, the configured language and time zone, and the name of the user's browser or app. OpenAI notes that the signals a site receives may vary while support is rolled out.

A business that uses a third-party risk provider should ask that provider to confirm its configuration takes in the new signals. A business with its own risk system should start observing the header. OpenAI's announcement names Forter, Riskified, Sardine and Signifyd as fraud prevention partners, and Adyen, Checkout.com and Stripe as payment service providers it is working with.

Product feeds and Business Hub

Product discovery is a separate track from payment. OpenAI's product feed guide says ChatGPT can use product feeds along with other retail and public web sources to find products. A feed supplies structured catalog data. It does not update a cart or confirm a purchase, and the live website or plugin still checks the current offer when the customer acts.

Feeds are set up in the Business Hub OpenAI launched earlier in November. The guide's sequence is to claim the business, verify identity in the product section, choose the countries and currencies where the business sells, prepare the feed to OpenAI's schema with stable item IDs, and deliver it by manual upload, a hosted HTTPS URL or SFTP.

OpenAI is explicit that the two tracks do not depend on each other. A merchant does not need a feed or a plugin for ChatGPT's cloud browser to use its site. This is where the announcement bears on AI search. That is the visibility question behind ChatGPT SEO and wider generative engine optimisation work.

What came before: Instant Checkout

PPC Land reported on 14 November 2026 that ChatGPT Wallet is OpenAI's second attempt at a payment step and that the first, Instant Checkout, launched on 29 September 2025 and was shut down in March 2026.

According to PPC Land, Instant Checkout completed the transaction inside ChatGPT. Wallet sends the agent to the merchant's own website with a payment token that works with the existing checkout page. For a merchant, that moves the work away from a new checkout integration and towards access and fraud settings.

What OpenAI did not say

Several things a merchant would want to know are missing from the announcement and the guides.

• There is no expansion timetable and no list of further countries.
• There is no merchant fee or pricing for accepting Wallet payments.
• The announcement and the guides give no list of eligible card issuers. OpenAI's help centre article on Wallet says it takes eligible US-issued American Express, Chase, Mastercard and Visa credit cards, and that debit cards are not supported.
• There is no date for fully delegated, pre-approved purchases.
• OpenAI does not say which merchants, or how many sites, currently work with Wallet.
• The product feed guide asks merchants to choose countries and currencies but does not list which are offered. OpenAI's product feed schema says the standard upload currently targets the US as the destination market and that other markets need OpenAI's confirmation. The sources do not say whether a business based in Thailand can upload a feed.

OpenAI also calls Wallet the first of its kind. That is the company's own description, and the announcement does not say what it was compared against.

What this means for Thai marketers

This section is analysis, not something OpenAI stated. No Thai consumer can pay with ChatGPT Wallet today, so a Thai store that sells only to Thai customers will see no change in orders this week. The picture is different for a Thai business that sells to customers in the United States. As the wallet rolls out, its US buyers on ChatGPT Pro can send an agent to the checkout, and that agent will either get through or be blocked.

The access and risk guidance in the playbook is written without a regional limit in the documents reviewed. A Thai merchant on Cloudflare, Akamai or Vercel can check how its bot rules treat verified ChatGPT browser visits. A merchant can also ask its fraud provider or payment gateway whether it reads the Forwarded header. The sources do not say whether Thai payment providers support it, so that is a question to put to the provider.

Access and risk checks cost little and do not depend on the wallet reaching Thailand. OpenAI's product feed schema says the standard feed upload currently targets the US. For most teams running e-commerce marketing, a sensible first step is a conversation between marketing, the web team and whoever manages the firewall, because the setting that blocks an agent is rarely owned by the marketing team.

ChatGPT Wallet FAQ

Is ChatGPT Wallet available in Thailand?

No. OpenAI's 13 November 2026 announcement limits ChatGPT Wallet to ChatGPT Pro subscribers aged 18 or older in the United States with eligible US-issued cards. The source does not say when other countries will follow.

Do merchants need to integrate anything to accept ChatGPT Wallet?

No Wallet-specific integration is required, according to OpenAI's accept payments guide. Wallet works with existing checkout pages and payment forms. OpenAI still recommends checking that the CDN or firewall does not block verified ChatGPT browser visits and that risk systems read the Forwarded header.

Does the merchant see the customer's card number?

No. OpenAI says the merchant receives a network token instead of the card number and can use the Payment Account Reference to link the token to the underlying account. The credential is for one transaction and must not be saved or reused.

What is Web Bot Auth?

Web Bot Auth is the method ChatGPT uses to sign certain automated browser requests so a site can verify they came from ChatGPT. It uses the HTTP Message Signatures standard, RFC 9421. OpenAI says Akamai, Cloudflare, HUMAN and Vercel verify these signatures automatically.

How much does it cost a merchant to accept ChatGPT Wallet?

The source does not say. Neither OpenAI's announcement nor its Commerce Partner Playbook states a merchant fee for Wallet payments.

Where this leaves merchants

ChatGPT Wallet is a US-only, Pro-only payment method as of 13 November 2026. The merchant checklist published with it is broader: confirm that the agent is not blocked, confirm that the fraud system can read the signals OpenAI now sends, and keep product data accurate where ChatGPT can read it. A team that wants help checking how its store appears in ChatGPT and whether agents can reach its checkout can talk to Relevant Audience about a ChatGPT visibility review.