CHcheckout
Agentic Commerce Protocol

Create a delegated payment token

Creates a delegated payment token to securely enable Checkout.com merchants to process agentic payments.

The token secures cardholder credentials for use in agentic commerce transactions. You must provide:

  • The card details
  • The spending constraints (allowance)
  • The Billing address
  • The risk signals

The request must include a valid HMAC-SHA256 signature in the Signature header and a timestamp in the Timestamp header to verify the request integrity.

post/agentic_commerce/delegate_payment

Request

Headers

Signaturestring required

A Base64-encoded HMAC-SHA256 signature used for request body integrity verification.

Compute the signature as follows:

  1. Concatenate the Timestamp header value (as a UTF-8 string) with the raw JSON request body (as a UTF-8 string).
  2. Compute the HMAC-SHA256 hash of the concatenated string using your shared HMAC signing key.
  3. Base64-encode the resulting hash.

Example: Base64(HMAC-SHA256(key, Timestamp + RequestBody))

Timestampstring date-time required

The timestamp of the request, in RFC 3339 format (for example, 2026-03-11T10:30:00Z).

The timestamp must be within 5 minutes of the server time. Requests with a timestamp outside this window are rejected with a 401 response.

Cko-Idempotency-Keystring

An optional idempotency key for safely retrying payment requests

API-Versionstring

The API version to use for the request. If not specified, the default version (2026-01-30) is used.

Request body

metadataobject required

A set of key-value pairs to attach to the delegated payment request.

The metadata object only supports string values.

Example request

{
  "payment_method": {
    "type": "card",
    "card_number_type": "fpan",
    "number": "4242424242424242",
    "exp_month": "11",
    "exp_year": "2026",
    "name": "Jane Doe",
    "cvc": "223",
    "cryptogram": "gXc5UCLnM6ckD7pjM1TdPA==",
    "eci_value": "07",
    "checks_performed": [
      "avs",
      "cvv",
      "ani",
      "auth0"
    ],
    "iin": "123456",
    "display_card_funding_type": "credit",
    "display_wallet_type": "wallet",
    "display_brand": "Visa",
    "display_last4": "4242",
    "metadata": {
      "issuing_bank": "temp"
    }
  },
  "allowance": {
    "reason": "one_time",
    "max_amount": 10000,
    "currency": "USD",
    "merchant_id": "cli_vkuhvk4vjn2edkps7dfsq6emqm",
    "checkout_session_id": "1PQrsT",
    "expires_at": "2025-10-09T07:20:50.5200000+00:00"
  },
  "billing_address": {
    "name": "John Doe",
    "line_one": "123 Fake St.",
    "line_two": "Unit 1",
    "city": "San Francisco",
    "state": "CA",
    "postal_code": "12345",
    "country": "US"
  },
  "risk_signals": [
    {
      "type": "card_testing",
      "score": 10,
      "action": "blocked"
    }
  ],
  "metadata": {
    "campaign": "q4"
  }
}

Response

Delegated payment token created successfully

idstring required

The unique identifier of the provisioned payment token.

createdstring date-time required

The date and time the token was created, in RFC 3339 format.

metadataobject required

A set of key-value pairs containing response metadata.

Example response

{
  "id": "vt_abc123def456ghi789",
  "created": "2026-03-11T10:30:00.0000000+00:00",
  "metadata": {
    "psp": "checkout.com"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.