PegasusShopify’s agent checkout treats a verified signature as identity, not permission
Shopify’s developer docs for Checkout WebMCP let browser agents read and fill a live checkout, identified by Web Bot Auth signed requests, but they cannot enter new card numbers and must show the buyer the order and total and get a yes before placing it, and ask again if the total changes.
Your doorWhatever platform you run, draw the same line at your own checkout: let verified agents prepare the order, require a fresh buyer confirmation to place it, and record that confirmation with the order.
Source: Shopify developer docs, Oct 27, 2026 · Checkout WebMCP ↗
Q2 Who authorized it?
Get The Door.
One email every two weeks: the takes that mattered, which question moved, and what to do at your own door. Three minutes to read.
The link goes to the original source; the words are ours. References do not imply endorsement. Layer and question tags are our reading of the field, not claims made by the source. Approved by Reggie.