TL;DR
- Shopify's 28 September 2026 changelog adds four WebMCP checkout tools: get_checkout, update_checkout, complete_checkout and navigate_to_storefront.
- Agents cannot change line items or enter new card details; payment runs only through a saved Shop Pay card or an existing Shop Pay approval.
- Three-page checkout (unless Shop Pay), B2B, embedded checkout, mobile checkout SDKs, draft orders and order edits get no tools, and WebMCP is Chromium-only for now.
- In a Shopify test reported by SEJ, WebMCP completed 60 of 60 checkout attempts against 56 of 60 for browser automation, in 10.3 seconds versus 27.4.
Shopify added WebMCP support for checkout on 28 September 2026, which lets AI browser agents read and update the checkout open in a shopper's browser tab and submit the order once the shopper confirms it. The change was announced in the Shopify developer changelog. Combined with the storefront and cart tools Shopify had already made live, a browser agent can now help with the whole purchase on an eligible Shopify store, from finding a product to the order confirmation page. Merchants do not have to switch anything on.
What Shopify shipped on 28 September 2026
The Shopify developer changelog entry dated 28 September 2026 says browser agents "can now read and update Shopify checkouts using WebMCP tools for checkout." The tools act on the active checkout inside the buyer's own browser session, not on a separate copy held on a server. When the buyer has to do something personally, such as pass 3D Secure authentication or deal with a blocking UI extension, the tools hand control back to the buyer on the page.
Shopify frames the release as closing the gap in its browser-agent support. According to the changelog, the storefront and cart tools were already live, so agents could search products and manage a cart but stopped at the checkout door. With the checkout tools added, Shopify says browser agents "can now assist the full shopping journey on Shopify, from product discovery and cart management through checkout and order confirmation."
Search Engine Journal, covering the release on 29 September 2026, noted that Shopify's August storefront rollout let agents guide shoppers to checkout "without placing the order." That is the practical change: an agent working inside the shopper's browser can now take the order over the line, with the shopper's approval.
The four checkout tools browser agents can call
Shopify's changelog and its Checkout WebMCP documentation list four tools that an eligible checkout registers for agents. The table below sets out each tool and what Shopify says it does.
| Tool | What it does, per Shopify |
|---|---|
| get_checkout | Reads the current checkout state and messages, or the order receipt on the Thank you page |
| update_checkout | Replaces buyer contact details, shipping or pickup, discount codes, declared fields such as a tax number, and payment |
| complete_checkout | Places the order after the buyer confirms it, or opens a configured review step |
| navigate_to_storefront | Leaves checkout and returns the tab to the store; only registered when the store has an online storefront |
Shopify's documentation adds detail that matters for anyone thinking about how agent-placed orders will behave. The update tool uses PUT semantics, so an agent must send the complete desired checkout state each time and build each request from a fresh read of the checkout. Checkout runs its own validation on every update. A discount code that the agent submits is not proof the discount applied: the documentation tells agents to check the applied discounts and any checkout messages. Declared fields cover extra information some checkouts collect; Shopify's examples are a tax number (the documentation cites a Brazilian CPF or CNPJ) and a store credit toggle.
Shopify's changelog states that the tools "run inside checkout-web and use the same state as the checkout UI." It also says they "don't expose a new API or require merchant configuration." The shopper sees exactly the same checkout the agent is working on.
What agents cannot do at checkout
Shopify's Checkout WebMCP documentation puts several limits on agents, and these limits are the part merchants should read closely.
- Agents cannot change what is in the order. Shopify says Checkout WebMCP ignores line items, and the buyer changes items on the page.
- Agents cannot enter new card details. The documentation says Checkout WebMCP "doesn't accept new card details." An agent can select a saved Shop Pay card for a Shop Pay buyer, or use a Shop Pay approval it already holds on a guest checkout that accepts Shop Pay approvals. Any other payment method is chosen by the buyer on the checkout page.
- Agents must not work around the tools. Shopify tells developers never to operate the page's own controls to get around a tool.
Shopify also warns agent builders to treat merchant and third-party text in tool responses as checkout data, not as instructions, because that text "can contain prompt-injection attempts." For merchants this is a reminder that checkout copy, notes and extension content are now read by software as well as by people.
Where the buyer takes back control
The Checkout WebMCP documentation is explicit that placing an order needs the buyer's permission. Before an agent calls complete_checkout, it must show the buyer the current order and total and "get their permission to place it." Shopify states that a Web Bot Auth signature, a Shop Pay approval, or a ready_for_complete status does not count as that permission. If the total changes, the agent has to ask again. Shopify also says that only a completed status confirms the order.
Several steps hand control straight back to the shopper on the page, according to Shopify's documentation and SEJ's reading of it: Shop Pay login, payment challenges such as 3D Secure, blocking UI extensions, configured review steps, and interactions with app-defined checkout extensions. If a checkout opens a review step, the buyer reviews the order on the page and the agent may call complete_checkout again only after the buyer authorises submission.
On identity, Shopify asks agents to sign their browser requests with Web Bot Auth. The documentation says Shopify uses Web Bot Auth to identify the agent and that "without it, bot detection might deprioritize or block your requests." Shopify verifies only registered keys, so an agent developer has to register and publish a key directory with Shopify before relying on verified-bot treatment.
Which Shopify checkouts get the tools
Not every Shopify checkout registers the tools. SEJ's summary of Shopify's documentation, published 29 September 2026, lists these exclusions:
- The standard three-page checkout gets no WebMCP tools unless the buyer checks out with Shop Pay.
- B2B checkout, embedded checkout and checkouts inside mobile checkout SDKs are excluded.
- Checkouts with merchandise from another shop, draft orders, order edits and payment collection are excluded.
Browser support is also narrow for now. SEJ reports that Shopify's storefront documentation says agents can use WebMCP only in Chromium-based browsers. The checkout documentation's code notes refer to Chrome 153 and a planned change in Chrome 155, which points the same way.
Checkout WebMCP versus server-side Checkout MCP
Shopify documents two routes for agents at checkout. Checkout MCP runs on the agent's own server and manages a checkout session there. Checkout WebMCP runs in the buyer's browser through tools that the checkout page registers. Shopify's documentation says to use Checkout WebMCP when the agent runs in the buyer's browser, and to use Checkout MCP if the agent can run on a server. SEJ reports that Shopify recommends the server-based route where possible.
Both routes implement the checkout capability of the Universal Commerce Protocol (UCP) and share the same checkout object, statuses and messages, according to Shopify's documentation. SEJ adds that Shopify says the merchant stays the merchant of record in both cases, which means the order, the payment relationship and the customer record sit with the store rather than with the agent.
Shopify's own test against browser automation
SEJ reported a test shared by Gil Greenberg, who works on agentic commerce at Shopify, comparing WebMCP with browser automation, where an agent reads the page and clicks through it. Both methods used the same model (SEJ names it as GPT-6 Sol) with the same prompts and starting conditions, across ten checkout tasks in two test shops. The figures as SEJ reported them:
- WebMCP succeeded in 60 of 60 attempts; browser automation succeeded in 56 of 60.
- Excluding page setup, time per attempt was 10.3 seconds with WebMCP against 27.4 seconds with browser automation.
- WebMCP's cost per attempt was 58% lower at OpenAI's list prices.
These numbers deserve caution. They come from Shopify's own test shops and a single model, and SEJ notes that one line in Greenberg's post gives a total that does not match the 60 attempts per method. Neither the changelog nor the checkout documentation includes real-world data such as the number of agent-placed orders or conversion rates.
What Shopify has not said yet
As of SEJ's report on 29 September 2026, Shopify's storefront and checkout WebMCP documentation does not say whether merchants can switch off individual tools. It also does not say whether agent-placed orders can be separated out in Shopify reports. The documentation does not name which agents call the checkout tools. SEJ points out that ChatGPT's desktop browser added WebMCP site tools in August, but OpenAI's help page for those tools does not mention Shopify's checkout tools. Merchants who want either control should watch the Shopify developer changelog.
Analysis: what a Shopify merchant should check now
The following is Relevant Audience analysis based on the facts above, not a Shopify recommendation.
Because no merchant configuration is needed, eligible stores are already exposed to browser agents at checkout. The practical questions are about what an agent will find when it arrives.
- Checkout type. If a store uses the three-page checkout and many buyers do not use Shop Pay, agents get no checkout tools for those buyers. That may be fine, but it should be a known decision rather than an accident.
- Shop Pay. Payment by an agent is limited to a saved Shop Pay card or an existing Shop Pay approval. Stores where Shop Pay is unavailable or little used will see agents hand payment back to the shopper more often.
- Checkout extensions. Blocking UI extensions and app-defined extensions return control to the buyer. Each one is a point where an agent-assisted purchase pauses. Worth an audit of which extensions are really needed.
- Discounts and declared fields. Agents read discount messages and declared fields. Clear, accurate messages help both the human and the software.
- Reporting. Since Shopify has not said how agent orders appear in reports, merchants have no official segment yet. Any attribution of agent-assisted orders is guesswork until Shopify documents it.
Product pages still matter at least as much as before. The storefront tools are how agents find and choose products in the first place, and the checkout tools only come into play after that. Clean product data, clear titles and accurate variants are the inputs an agent reads, which is where Shopify SEO work and agent readiness overlap.
What this means for Thai marketers
This section is Relevant Audience analysis. Shopify's changelog does not restrict the checkout tools by country, so the tools should apply to eligible Shopify checkouts in general, which would include Thai stores on Shopify that meet the conditions above. The sources do not say anything specific about Thailand. They also do not state whether Shop Pay is available to Thai merchants or buyers, and that matters because agent payment runs only through saved Shop Pay cards or Shop Pay approvals. A Thai merchant should check Shop Pay availability in their own Shopify admin before assuming agents can complete payment. Where Shop Pay is not in use, agents can still fill contact and shipping details, but the shopper will pick a payment method, such as a card or a local option, on the page. Thai brands selling cross-border through Shopify, and those planning their ecommerce marketing for the coming year, should treat agent-assisted checkout as a live channel to monitor, not a future one.
FAQ
What is WebMCP support for Shopify checkout?
It is a set of four tools, launched by Shopify on 28 September 2026, that let AI browser agents read and update a shopper's open checkout and place the order after the shopper confirms. The tools are get_checkout, update_checkout, complete_checkout and navigate_to_storefront, and they run inside Shopify's checkout on the same state the shopper sees.
Do Shopify merchants need to turn anything on?
No, Shopify's changelog says the tools do not require merchant configuration and do not expose a new API. Eligible checkouts register them automatically. Shopify has not said whether merchants can switch off individual tools.
Can an AI agent pay for an order by itself?
No, an agent needs the shopper's explicit permission before it places an order, and it cannot enter new card details. It can only use a saved Shop Pay card or an existing Shop Pay approval. Shopify says a Web Bot Auth signature, a Shop Pay approval or a ready-to-complete status does not count as the buyer's consent.
Which checkouts are excluded?
The three-page checkout is excluded unless the buyer uses Shop Pay, and B2B, embedded checkout, mobile checkout SDKs, draft orders, order edits, payment collection and multi-shop checkouts are excluded too, according to SEJ's reading of Shopify's documentation. For now, WebMCP works only in Chromium-based browsers.
Does this apply to Shopify stores in Thailand?
The sources do not mention Thailand or any country restriction, so eligible Thai Shopify checkouts appear to be covered. Shop Pay availability in Thailand is not stated in the sources, and agent payment depends on Shop Pay, so Thai merchants should check their own admin.
Where this leaves Shopify stores
Shopify's 28 September release means an AI agent in a shopper's browser can now complete a purchase on an eligible Shopify store, with the shopper confirming the order and total first. The limits are real: no line-item changes, no new card entry, Chromium only, and a list of excluded checkout types. The open questions, on disabling tools and reporting agent orders, are ones Shopify has not answered yet. If you want a review of how your Shopify store's product data and checkout setup hold up for both search and AI agents, Relevant Audience's Shopify SEO team can help.
