American Express Agentic Commerce Experiences (ACE) vs x402

American Express Agentic Commerce Experiences (ACE)

ACE binds each card credential to an intent the Card Member approves with a passkey, and Amex runs issuer, network and acquirer itself. Outside developers can read only overview pages. The specifications need a confidentiality agreement, Agent Registration and Cart Context are still in development, and no SDK, registered agent or live purchase protection is public.

x402

No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781).

American Express Agentic Commerce Experiences (ACE)

1. Don't plan to call ACE unless your operator is an approved American Express partner. Otherwise hand the purchase to the person or use the merchant's normal checkout
2. Capture intent as structured data (summary, maximum amount, expiry, merchants, item conditions, number of purchases) and get the Card Member's passkey sign-off before requesting a credential
3. Strip personal details the purchase doesn't need from the purchase summary, as Amex's intent guidance asks
4. Avoid subjective intent such as 'best'. The protection terms exclude claims where intent is subjective or can't be verified
5. Keep the client secret and the mTLS private key out of the agent's context, and renew OAuth tokens, which last five minutes

x402

1. Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing
2. Use the upto scheme when the final price isn't known, and cap it
3. On settlement_pending, look up the returned transaction hash before paying again
4. Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only
5. Give the agent its own wallet with a small balance, never a treasury key