OpenAI launches ChatGPT Wallet for approved agent purchases

• Dots can complete purchases without seeing actual card details, with ChatGPT’s announcement requiring approval and a security check for every purchase.
• Access starts with US ChatGPT Pro subscribers through dots, according to the rollout announcement.
• American Express, Mastercard and Visa are the payment partners named in ChatGPT’s partner announcement.
• Existing card rewards and eligible-dispute protections remain in place, according to the launch announcement shared by TheRealAdamG.

The nicest engineering detail is buried in the payment docs: Wallet works with existing checkout forms without a Wallet-specific integration. OpenAI is also relaying user context through HTTP headers to help fraud systems recognize legitimate purchases from its cloud browser.

A purchase moves through four steps in OpenAI’s walkthrough:

1. Save a card. The user adds their card once.
2. Review the purchase. ChatGPT presents the items, total and selected card.
3. Authorize it. A security check, such as Face ID or a fingerprint scan, creates a record of the purchase the user authorized.
4. Issue the payment token. After approval, the payment network supplies a substitute card number, security code and expiration date.

The selected card gets charged while its actual details stay hidden from both the merchant and agent, as the launch announcement explains.

Wallet began rolling out on November 13 through dots, as described in the rollout announcement. The eligibility rules restrict initial access to US Pro subscribers aged 18 or older with eligible US-issued cards.

The Commerce Partner Playbook separates four merchant-facing pieces, detailed in OpenAI’s launch post:

• Product information: Verified businesses can update their details and upload feeds with current prices and availability.
• Browser access: CDNs and firewalls can recognize signed agent requests using Web Bot Auth. Browser access requires neither a plugin nor a product feed.
• Payment acceptance: Wallet tokens work with existing checkout flows, but risk systems may still decline or cancel legitimate agent purchases.
• Structured actions: Optional plugins can expose availability checks and cart operations. Websites can also add WebMCP tools.

Customers still transact directly with the merchant, which retains control of pricing, fulfillment, returns and customer service.

Cloud-browser IP addresses and browser details can trip bot defenses, according to the payment documentation. OpenAI is rolling out user signals through the Forwarded HTTP header:

• Network context: Observed user IP (for), masked network prefix (ip-prefix), origin autonomous system number (asn) and IP-derived country (ip-country).
• Client context: Configured locale (locale), IANA time zone (tz) and browser or app identification (user-agent).

The available signals vary as support rolls out across sites.

The payment guide distinguishes transaction authorization from permission to charge again:

• Separate purchases: Consent covers the specific transaction. The payment credential cannot be saved or reused for another purchase.
• Subscriptions: Recurring billing is supported when the existing checkout supports it and the customer consents to recurring charges. The guide points merchants to their processors’ merchant-initiated transaction practices.
• Existing saved cards: A merchant’s authorized card-on-file flow remains a separate payment option alongside Wallet.

Fully delegated buying remains a future capability. OpenAI’s launch post describes preapproved purchases bounded by spending limits, purchase categories or time periods, with additional safeguards.