Aimerce Blog

AI Agents Can Now Check Out on Your Shopify Store

17 October 2026

AI Agents Can Now Check Out on Your Shopify Store

First-Party Data 101Shopify

Quick Answer: On September 28, 2026, Shopify extended WebMCP to checkout. AI agents running in a shopper's own browser can now read your checkout, update contact details, shipping, and discount codes, select a saved Shop Pay card, and place the order once the shopper confirms. It's on for eligible checkouts with no merchant configuration. Unlike Meta's or TikTok's in-app checkouts, these orders happen on your own checkout page, in the shopper's own browser, so the order lands in Shopify like any other. The tracking questions are subtler: agents can skip the product pages your funnel events depend on, apply discount codes, and move faster than any human, so agent-placed orders can quietly change your funnel data, your discount costs, and what your ad platforms learn.

Key Takeaways

AI agents in a shopper's browser can now complete your Shopify checkout after the shopper confirms. There's no setting to turn it on, and Shopify's documentation doesn't describe one to turn it off.
The agent works on your real checkout, in the shopper's real browser session. The order is created in Shopify like any other.
Agents can apply discount codes. If codes leak to coupon sites, an agent may find and use them more reliably than a person would.
Agents can reach checkout without loading the product pages a human would view, which can thin out the browsing signals your ad platforms learn from.
Shopify hasn't documented whether merchants can tell an agent-placed order from a human one. Run a test order yourself to see how one looks in your data.

We've spent the last few weeks writing about checkouts that leave your store: Meta's Messenger and Muse checkouts, TikTok's Buy Direct. This one is the opposite. The checkout stays on your store, and the shopper stays in their own browser. What changes is who's filling it in.

Since September 28, an AI agent working in a shopper's browser can open your checkout, enter the shipping address, pick a delivery option, apply a discount code, and submit the order once the shopper says yes. Shopify switched it on for eligible stores without any setup, which means most merchants have no idea it's live.

That's not a reason to panic. It's a reason to understand what an agent-placed order looks like in your data before BFCM sends more of them your way.

What exactly did Shopify launch?

Shopify's developer changelog says browser agents can now read and update Shopify checkouts using WebMCP tools. WebMCP is a proposed web standard that lets a page offer AI agents structured actions, so the agent doesn't have to click through HTML built for people.

Shopify added WebMCP tools to Liquid storefronts in August, letting agents search products and manage the cart. On September 28, it added checkout. The checkout registers four tools:

get_checkout reads the current checkout, or the order receipt on the Thank You page.
update_checkout changes contact details, shipping, discount codes, and declared fields. For payment, it can select a saved Shop Pay card or set a billing address. It can't enter new card details.
complete_checkout places the order after the buyer confirms it.
navigate_to_storefront returns the tab to your store.

The tools run inside Shopify's checkout and use the same state as the checkout the shopper sees. According to Shopify, they don't expose a new API or require merchant configuration.

What can an agent do, and what can't it?

Shopify built in some real guardrails.

The shopper stays in control of the order. The agent can only place the order after the shopper confirms it. When the shopper's input is required, such as a 3D Secure payment check, Shop Pay login, or a checkout extension that needs a response, the tools hand control back to the shopper.

Agents are asked to identify themselves. Shopify tells agents to sign their browser requests using Web Bot Auth. Unsigned requests may be deprioritized or blocked by bot detection.

There are limits on what changes. The checkout tools handle contact details, delivery, discount codes, and declared fields. For payment, the agent can only select a saved Shop Pay card or set a billing address. Any other payment method, the shopper chooses on the page. Changing the items in the cart stays with the storefront and cart tools, or the shopper.

Not every checkout is eligible. Shopify doesn't register the tools on several checkout types: the standard three-page checkout unless the shopper uses Shop Pay, B2B checkouts, embedded and mobile SDK checkouts, checkouts with merchandise from another shop, and draft orders. Agent support is also limited to Chromium-based browsers for now.

One thing that isn't documented: a way for merchants to switch the checkout tools off. As of early October, Shopify's documentation doesn't describe one.

How is this different from Meta and TikTok checkouts?

	Meta and TikTok in-app checkouts	AI agents on your Shopify checkout (WebMCP)
Where checkout happens	Inside Meta's or TikTok's apps	On your own Shopify checkout page
Whose browser	None of yours, the app handles it	The shopper's own browser session
Who fills in the checkout	The platform	An AI agent, after the shopper confirms
Do storefront pixels see it?	No	The checkout page itself loads in the browser, but the browsing before it may be missing
Merchant setting	Toggles under Sales channels	None documented

What does this mean for your tracking?

This is where it gets interesting, because nothing here is broken in the obvious way. The order happens on your checkout, so it shows up in Shopify like any other. The changes are quieter.

Your funnel can thin out. A person browses product pages, adds to cart, and then checks out, and every step fires an event your ad platforms learn from. An agent can read product data through Shopify's catalog tools without loading a product page at all. Whether it does is the agent's choice, since some tools still take the shopper to the product page. Cart changes made by an agent behave like the shopper's own. If agent shopping grows, you may see purchases with fewer product view events in front of them. That makes funnel reports look odd, and it gives Meta and Google less browsing behavior to learn from.

Discount codes get easier to use. The checkout tools can apply discount codes. If your codes leak onto coupon sites, an agent can find and apply them more reliably than a person would. That costs you margin, and if affiliate codes are involved, it can send commission and credit to the wrong partner.

The main checkout events should fire normally. The agent works on the checkout open in the shopper's tab, and the shopper sees the same checkout it's filling in. The order lands on the normal Thank You page, which is where checkout_completed fires. So checkout_started and checkout_completed should behave like any other order, with the usual consent and ad blocker caveats. What Shopify hasn't documented is whether the step events in between, like contact info, address, shipping, and payment info submitted, fire when the agent fills those fields instead of the shopper.

The purchase itself is the safest part. Because the order is created in Shopify, a purchase sent server-side from Shopify's order data reaches your ad platforms no matter how the checkout was filled in. That's the event you most need. Just make sure it still carries the browser identifiers Meta uses for matching, like fbc and fbp. When a purchase reaches Meta without IP address, user agent, fbc, or fbp, match quality drops.

Attribution depends on what's already in the browser. Everything the agent does happens in the tab the shopper is looking at, in the shopper's own browser, so ad click data already stored there, such as the _fbc cookie Meta's pixel saves on your domain, is still available. What hasn't been documented is how ad platforms treat a purchase an agent completed. Shopify's checkout tools also ignore UCP's attribution field, so the agent can't hand campaign data to the checkout the way we described in "How UCP's Attribution Field Reconnects Agentic Commerce to Your Pixel." Credit depends on click data the shopper's browser already holds. If the agent found your store on its own rather than through an ad, there's no click to credit.

Can you tell an agent order from a human one?

Not easily, as far as Shopify's public documentation goes. Shopify asks agents to sign their requests so they can be verified, but it hasn't documented whether that shows up anywhere a merchant can see, such as on the order or in Analytics.

There's also a separate change to keep in mind. Since September 21, Shopify Analytics filters identified bot sessions out of session reports by default. Whether agent sessions are treated as bots isn't documented. Shopify describes its classification as conservative: a session with relevant human activity counts as human, even if many of its events look automated. In an agent checkout, the shopper is still on the page, logging in to Shop Pay and confirming the order, so it seems unlikely these sessions disappear entirely. But that's our reading, not Shopify's statement.

What should you do now?

Run a test order through an agent yourself. Use a browser-based agent that supports WebMCP, in a Chromium-based browser. Watch which address and delivery option it picks, whether your discount and delivery rules hold, and how the order appears in Shopify.
Check the order in your ad platforms. Confirm the test purchase reaches Meta and Google. Note which events fired before it: product views, add to cart, checkout started, and the contact, address, shipping, and payment info submitted steps. Then confirm the server-side Purchase still carries fbc and fbp.
Audit your discount codes. Retire codes that have leaked to coupon sites, and set usage limits on high-value codes before BFCM.
Make sure Shop Pay is working. A saved Shop Pay card is the only payment method an agent can select on its own, so the saved-card experience matters.
Read your checkout like a machine would. Ambiguous delivery option names and unclear checkout copy are easy for a person to interpret and easy for an agent to get wrong.
Send purchases server-side. It's the one part of your tracking that doesn't care whether a person or an agent filled in the checkout.

How Aimerce handles agent-placed orders

Aimerce doesn't depend on the checkout being filled in by a person. On Shopify storefronts it runs through a web pixel and webhooks, and purchases reach Meta and Google server-side from Shopify's order data. An order an agent placed on your checkout is created in Shopify like any other, so it's sent like any other.

FAQ

Can AI agents check out on my Shopify store? Yes. Since September 28, 2026, AI agents running in a shopper's browser can use Shopify's WebMCP checkout tools to read the checkout, update contact, shipping, and discount details, select a saved Shop Pay card, and place the order after the shopper confirms it.

Do I need to turn anything on for agents to use my checkout? No. Shopify says the tools don't expose a new API or require merchant configuration. Shopify's documentation also doesn't currently describe a way to turn them off.

Can an AI agent place an order without the shopper's approval? No. The agent can only submit the order after the shopper confirms it, and the tools hand control back to the shopper for steps like 3D Secure checks or Shop Pay login.

Do my tracking pixels fire on agent-placed orders? The main checkout events, checkout started and checkout completed, should fire as usual, because the checkout runs in the shopper's own tab and ends on the normal Thank You page. Shopify hasn't documented whether the in-between step events fire when an agent fills in the fields, and agents can skip product pages before checkout. Run a test order to see what fires on your store.

Can AI agents use my discount codes? Yes. Shopify's checkout tools let agents apply discount codes. Audit leaked codes and set usage limits on high-value ones.

Is this the same as Meta's or TikTok's checkout? No. Meta's and TikTok's checkouts happen inside their own apps, where your storefront pixels never run. WebMCP checkouts happen on your own Shopify checkout page, in the shopper's own browser.