Testing an AI shopping agent's checkout flow? There's no sandbox for that yet — so I built one

A developer built acp-sandbox, a hosted mock merchant implementing the Agentic Commerce Protocol (ACP) checkout API, to fill the gap in testing AI shopping agents. The sandbox supports the full checkout session lifecycle, logs requests per API key, and pairs with agent-identity-mcp for disposable buyer identities.

If you're building or evaluating an AI agent that can shop and check out on its own, you've probably run into the new "agentic commerce" protocols: ACP https://github.com/agentic-commerce-protocol/agentic-commerce-protocol OpenAI + Stripe + Meta , AP2 Google , and UCP. They define how an agent talks to a merchant to create a checkout session, apply a payment token, and get an order back. Stripe's own test mode covers the payment half fine — test cards, test API keys. But there's no hosted "fake merchant" you can point your agent at to verify the protocol half: does your agent correctly create a session, handle a 422 idempotency conflict, parse the order response, retry politely? You either mock it yourself from the spec, or risk finding out against a real merchant. So I built acp-sandbox — a small hosted mock merchant implementing the ACP checkout API, live at It implements the real checkout sessions lifecycle from ACP's 2026-04-17 spec https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/tree/main/spec/2026-04-17 : create, retrieve, update, complete, cancel. Responses match the actual CheckoutSession / Order / Error schemas for the fields it supports — I pulled the OpenAPI spec directly rather than guessing field names. get a test key, no signup curl -X POST https://acp-sandbox.flo-voice1.com/keys \ -H "Content-Type: application/json" -d '{"email":"you@example.com"}' create a session against the demo catalog curl -X POST https://acp-sandbox.flo-voice1.com/checkout sessions \ -H "Authorization: Bearer acps test ..." \ -H "Content-Type: application/json" \ -d '{"line items": {"id":"item demo headphones","quantity":1} ,"currency":"usd"}' Every request/response is logged per API key GET /logs , so you can see exactly what your agent sent when something doesn't work. complete always succeeds once you send payment data . delegate authentication flow. ready for payment .ACP is still beta 5 spec revisions in about 7 months , so this will need upkeep as the protocol moves. Scoped tightly on purpose rather than trying to cover AP2/UCP too — happy to extend it if there's real interest. If you're also building agent-identity-mcp https://github.com/flovoice53-tech/agent-identity-mcp or similar disposable email/phone for AI agents to use as a buyer identity , it pairs directly with this — identity on one side, a merchant to check out with on the other. Repo: https://github.com/flovoice53-tech/acp-sandbox https://github.com/flovoice53-tech/acp-sandbox Live: https://acp-sandbox.flo-voice1.com https://acp-sandbox.flo-voice1.com