# Testing an AI shopping agent's checkout flow? There's no sandbox for that yet — so I built one

> Source: <https://dev.to/flovoice53tech/testing-an-ai-shopping-agents-checkout-flow-theres-no-sandbox-for-that-yet-so-i-built-one-dgo>
> Published: 2026-08-26 06:46:59+00:00

If you're building or evaluating an AI agent that can shop and check out on its own, you've probably run into the new "agentic commerce" protocols: [ACP](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol) (OpenAI + Stripe + Meta), AP2 (Google), and UCP. They define how an agent talks to a merchant to create a checkout session, apply a payment token, and get an order back.

Stripe's own test mode covers the *payment* half fine — test cards, test API keys. But there's no hosted "fake merchant" you can point your agent at to verify the *protocol* half: does your agent correctly create a session, handle a 422 idempotency conflict, parse the order response, retry politely? You either mock it yourself from the spec, or risk finding out against a real merchant.

So I built ** acp-sandbox** — a small hosted mock merchant implementing the ACP checkout API, live at

It implements the real `checkout_sessions`

lifecycle from ACP's [2026-04-17 spec](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/tree/main/spec/2026-04-17): create, retrieve, update, complete, cancel. Responses match the actual `CheckoutSession`

/`Order`

/`Error`

schemas for the fields it supports — I pulled the OpenAPI spec directly rather than guessing field names.

```
# get a test key, no signup
curl -X POST https://acp-sandbox.flo-voice1.com/keys \
  -H "Content-Type: application/json" -d '{"email":"you@example.com"}'

# create a session against the demo catalog
curl -X POST https://acp-sandbox.flo-voice1.com/checkout_sessions \
  -H "Authorization: Bearer acps_test_..." \
  -H "Content-Type: application/json" \
  -d '{"line_items":[{"id":"item_demo_headphones","quantity":1}],"currency":"usd"}'
```

Every request/response is logged per API key (`GET /logs`

), so you can see exactly what your agent sent when something doesn't work.

`complete`

always succeeds once you send `payment_data`

.`delegate_authentication`

flow.`ready_for_payment`

.ACP is still beta (5 spec revisions in about 7 months), so this will need upkeep as the protocol moves. Scoped tightly on purpose rather than trying to cover AP2/UCP too — happy to extend it if there's real interest.

If you're also building [agent-identity-mcp](https://github.com/flovoice53-tech/agent-identity-mcp) or similar (disposable email/phone for AI agents to use as a buyer identity), it pairs directly with this — identity on one side, a merchant to check out with on the other.

Repo: [https://github.com/flovoice53-tech/acp-sandbox](https://github.com/flovoice53-tech/acp-sandbox)

Live: [https://acp-sandbox.flo-voice1.com](https://acp-sandbox.flo-voice1.com)