Browser agents can now fill in and submit Shopify checkout, but the buyer still confirms the order

Shopify's WebMCP tools previously covered the storefront and the cart. A changelog entry dated September 28, 2026 extends them to checkout, so an agent can follow a purchase from product discovery to order confirmation. The new tools run inside the checkout page and share the state the buyer sees on screen.

Four tools on the checkout page

Checkout registers its tools on the page's top-level document, and your agent discovers them through WebMCP. Shopify's documentation lists four:

• get_checkout reads the current checkout, or the order receipt once the order is placed;
• update_checkout replaces contact details, fulfillment, discount codes, extra fields such as a tax number, and the payment choice;
• complete_checkout places the order after the buyer confirms it;
• navigate_to_storefront leaves checkout and returns the tab to the store, and it appears only when the merchant has an online store.

The tool list changes during checkout

The available tools change as the buyer moves through checkout, so the documentation tells agents to listen for a change event and reload the tools before the next call.

Shopify says the tools appear on eligible checkouts. The documentation page does not list what makes a checkout eligible.

What the agent cannot do on its own

Before it calls complete_checkout, your agent has to show the buyer the current order and total and get permission. If the total changes, it asks again. Shopify states that neither a Web Bot Auth signature nor a Shop Pay approval counts as that permission.

When a store has a review step, the first call only opens it, and the agent calls again after the buyer approves the order on the page. A payment challenge such as 3D Secure is finished by the buyer in the same tab.

The tools do not accept new card details. A Shop Pay buyer is charged on the saved card they selected, and a guest checkout can use a Shop Pay approval.

What agent developers have to set up

Merchants configure nothing, and the changelog says the tools add no new API. The work falls on whoever builds the agent. Shopify asks you to sign browser requests with Web Bot Auth, using an Ed25519 key published in a key directory and registered with Shopify. Without it, the documentation warns, bot detection may deprioritize or block your requests.

The documentation also says to treat merchant and third-party text in tool responses as checkout data rather than instructions, because it can carry prompt injection. If your agent can run on a server, Shopify points you to its server-side Checkout MCP instead.