Obtain the AP2 trust anchors (root certificates or DID registry references) for the issuing party of the Payment Mandate Verifiable Credential from the AP2 specification
At the point of payment authorization, extract the PaymentMandate VC from the transaction metadata submitted by the agent's principal or agent platform
Verify the VC cryptographic signature against the trust anchor; check that the mandate's scope (allowed merchant category code, maximum amount, currency, and validity window) covers the current transaction
Pass the Human-Present and agent-involvement signals extracted from the mandate to your acquiring bank or payment network in the authorization request as specified by Visa/Mastercard AP2 integration guides; these signals affect authorization routing and liability rules
Store the verified mandate reference alongside the transaction record for dispute resolution and compliance audit; do not store the raw VC if it contains cardholder PII beyond what your data retention policy allows
Known gotchas
AP2 mandates are authorization credentials, not payment rails; a valid mandate does not guarantee settlement — you still need a functioning underlying payment instrument and acquiring relationship to move funds
The mandate's validity window is set at issuance by the user's agent platform and may be very short (minutes) for high-security use cases; if authorization latency exceeds the window, the mandate will fail verification even if all other fields match
AP2 VC verification libraries are available for common languages via the AP2 SDK, but the spec allows multiple VC proof formats; confirm which proof format your counterparties use (JWT-VC vs JSON-LD proof) before selecting a verification library
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp