Setup-Guide: Agentic Checkout Plugin for WooCommerce

WPMR Agentic Checkout for WooCommerce – Complete Setup Guide

Welcome to the Agentic Checkout setup guide!

This comprehensive guide will walk you through every step of setting up and configuring the WPMR Agentic Checkout plugin for WooCommerce. Enable your store to participate in OpenAI’s revolutionary “Buy it in ChatGPT” feature and reach over 700 million weekly ChatGPT users.

This plugin implements the Agentic Commerce Protocol (ACP), the open standard co-developed by OpenAI and Stripe that powers AI-driven commerce.

What is the Agentic Commerce Protocol?

The Agentic Commerce Protocol (ACP) is an open standard developed by OpenAI and Stripe that defines how AI agents communicate with e-commerce platforms. Think of ACP as the language that allows AI and e-commerce to speak to each other.

ACP enables:

• Product Discovery: AI agents can browse your product catalog
• Checkout Sessions: Creating and managing secure checkout sessions
• Payment Processing: Processing payments securely via Stripe
• Order Fulfillment: Handling shipping and order updates

How It Works:

1. Discovery: Your products are indexed from your WooCommerce site via WP Product Feed Manager
2. Buy Click: User clicks “Buy” in ChatGPT (your site must be approved by OpenAI)
3. Instant Checkout: Payment is confirmed in ChatGPT via Stripe (PCI-compliant)
4. Order Handoff: ChatGPT sends the order via Agentic Commerce Protocol
5. Plugin Validation: This plugin receives, validates inventory and shipping address
6. Accept/Decline: Plugin confirms or rejects the order to ChatGPT in real-time
7. Order Creation: If accepted, the order is created in WooCommerce as paid (status: Processing)
8. Fulfillment: You ship the product and provide customer support as normal

Requirements & Prerequisites

External Services Required

• OpenAI ACP Approval: OpenAI must approve your store
• Stripe Account: Required for payment processing (OpenAI ACP works exclusively with Stripe’s delegated payment system)
• SSL Certificate: HTTPS is mandatory for production use
• NTP Time Synchronization: Server clock must be synchronized to prevent timestamp validation failures

Installation Steps

Step 1: Install WP Product Feed Manager

Before installing WPMR Agentic Checkout, ensure you have WP Product Feed Manager installed and activated:

1. Go to Plugins > Add New in your WordPress admin
2. Upload the plugin file you have received
3. Click Install Now, then Activate

Step 2: Install WPMR Agentic Checkout

Option A: Install from WordPress.org (Recommended)

1. Go to Plugins > Add New in your WordPress admin
2. Search for “WPMR Agentic Checkout for WooCommerce”
3. Click Install Now, then Activate
4. You’ll be redirected to the settings page at Feed Manager > AI Checkout

Option B: Manual Installation

1. Download the plugin ZIP file from WordPress.org
2. Go to Plugins > Add New > Upload Plugin
3. Choose the downloaded ZIP file and click Install Now
4. Click Activate Plugin

Step 3: Apply for OpenAI ACP Approval

Before you can start receiving orders from ChatGPT, you must apply for and receive approval from OpenAI:

1. Visit OpenAI’s Buy it in ChatGPT page
2. Complete the application form with your store details
3. Wait for approval (this can take several days to weeks)
4. Once approved, you’ll receive access to the OpenAI ACP dashboard

Step 4: Set Up Your Stripe Account

If you don’t already have a Stripe account, create one:

1. Visit Stripe Registration
2. Complete your business profile
3. Verify your identity and bank account
4. Navigate to API Keys to retrieve your keys

Configuration Overview

After installation, navigate to Feed Manager > AI Checkout in your WordPress admin. The settings page is organized into several sections, each controlling a different aspect of the ACP integration.

Configuration Workflow: The settings page guides you through 5 main steps:

1. Apply for OpenAI ACP Approval
2. Obtain API Keys (OpenAI and Stripe)
3. Configure Plugin Settings
4. Set Up Product Feed
5. Test Your Integration

ACP API Settings

Enable ACP API

What it does: This setting enables the REST API routes (/wp-json/wpmrac/v1/) that ChatGPT uses to communicate with your store. If this is disabled, ChatGPT will receive a 404 Not Found error when attempting to create checkout sessions.

Test Mode

What it does: When enabled, all orders created through ChatGPT will be marked as test orders. These orders receive special order meta (_acp_is_test_order) and a clear order note indicating they are test orders.

When to use:

• During initial setup and configuration
• When testing the integration with OpenAI’s sandbox environment
• Before going live to ensure everything works correctly

OpenAI API Key

What it does: This is the Bearer token that OpenAI sends in the Authorization header of their ACP requests. The plugin uses this as the first line of defense for authentication.

Where to find it: After receiving OpenAI ACP approval, you’ll find your API key in the OpenAI ACP dashboard.

Stripe Payment Settings

According to the ACP Delegated Payment Specification, ChatGPT processes the payment intent at Stripe and sends a payment token to your shop. Your plugin then redeems this token to complete the payment.

Stripe Publishable Key

What it does: The publishable key is used for client-side operations. While primarily used by Stripe’s frontend libraries, it’s required for complete Stripe integration.

Stripe Secret Key

What it does: The plugin uses the Secret Key (backend) to redeem the delegated payment token from OpenAI for an actual payment (payment_intent) on your Stripe account.

Stripe Webhook Secret

To capture asynchronous status updates from Stripe (e.g., a payment that succeeds later), the plugin listens for Stripe webhooks via the endpoint /wp-json/wpmrac/v1/webhooks/stripe. This secret cryptographically verifies the Stripe-Signature header, ensuring the event originates from Stripe.

How to set up Stripe webhooks:

1. Go to your Stripe Webhooks Dashboard
2. Click Add endpoint
3. Enter your webhook URL: https://yoursite.com/wp-json/wpmrac/v1/webhooks/stripe
4. Select events to listen for:
   • payment_intent.succeeded
   • payment_intent.payment_failed
5. Copy the webhook signing secret and paste it in the plugin settings

Product Feed Settings

This setting links to the product feed created via WP Product Feed Manager. Without this feed, OpenAI won’t know which products are available in your store.

Creating a ChatGPT Product Feed

1. Go to Feed Manager > Manage Feeds
2. Click Add New Feed
3. Select ChatGPT / OpenAI as the channel
4. Configure your feed settings (products to include, attributes, etc.)
5. Save and generate the feed
6. Return to Feed Manager > AI Checkout and select your feed from the dropdown

Security Settings

These settings are mandatory for OpenAI ACP certification and production environments. The plugin strictly follows OpenAI’s guidelines for request authentication, validation, and idempotency.

Enable Signature Verification

How it works technically: The plugin validates the detached JWS (JSON Web Signature) in the Signature or X-OpenAI-Signature header. It checks the payload (the raw request body) against the OpenAI Public Key using RSA (RS256/384/512). This ensures the payload has not been tampered with in transit.

OpenAI Public Key

Where to find it: In your OpenAI ACP dashboard after approval. This is a specific key for ACP, not your general OpenAI API key.

Important: Without a valid, correctly formatted PEM key, signature verification will fail and the plugin will reject orders with HTTP 401.

Timestamp Tolerance

What it does: Prevents Replay Attacks. The plugin reads the X-OpenAI-Timestamp or Timestamp header. If the server time and the timestamp differ by more than this value (default 5 minutes), the request is rejected.

Idempotency Handling

Why this is crucial: The ACP protocol requires strict idempotency. OpenAI sends an Idempotency-Key header with each request.

• If there’s a network timeout, OpenAI will send the same request again
• If Idempotency is off, the customer would pay twice and you would get duplicate orders
• If Idempotency is on, the plugin recognizes the key in the database and returns the stored HTTP response from the first successful attempt
• On a parameter mismatch (same key, different body), the plugin returns HTTP 409 Conflict

IP Allowlisting (CIDR Validation)

How it works: The plugin dynamically retrieves authorized CIDR blocks from https://openai.com/chatgpt-connectors.json (the official OpenAI egress IP list) and stores them in the WordPress cache. Each incoming ACP request is checked against these subnets.

Fallback behavior: If OpenAI’s IP list cannot be retrieved temporarily:

• Allow — Requests proceed (less secure, but prevents downtime)
• Deny — Requests are rejected (more secure, but may cause temporary issues)