What happens when a customer's agent shops your store, step by step Free & Pro

A customer tells their assistant: "Order me another bag of the coffee I had from Northfield Roasters, and check my last order shipped." Here is everything that happens at a store running Agent Adapt, from both sides. The customer is Sam, the store is Northfield Roasters, the agent is whatever assistant Sam uses.

1. The agent finds the store

The agent fetches https://northfieldroasters.com/.well-known/poppy.json and the OAuth metadata it points to. It now knows the store’s name, that it can sign Sam in by link or by code, that there is an OpenAPI-described agent API, and that the store offers a checkout link.

Sam sees: nothing yet. You see: nothing. Discovery documents are public and leave no trace.

2. The agent proves who it is and starts a visit

The agent asks the store’s token endpoint for a Session, signing the request with its private key. The store fetches the agent’s public details and keys from the agent’s own address, checks the signature, checks the request hasn’t been replayed, and issues a Session Token bound to a key the agent holds. The visit is signed out. The store knows Sam only as an opaque ID the agent chose, which is stored hashed.

Sam sees: nothing. You see: the agent appears under WooCommerce → Agents with its published name and address, and its visit count goes up.

3. The agent searches

It calls the catalogue search with "coffee". The store answers from your real catalogue: names, prices, stock, variations, SKUs, image URLs. Hidden products don’t appear. If the agent asks for your returns policy, it gets your returns page as plain text.

Sam sees: the agent may ask "Was it the Ethiopian or the Colombian?", or move straight on if it already knows. You see: a search event against the agent’s visit, visible in Pro’s Agent insights.

4. The agent asks to use Sam’s account

To find Sam’s last order it needs to be signed in. It sends Sam a link to the store, asking for View your orders, their status and your saved addresses. (If the assistant is on a speaker or in a car, it shows a short code and the address northfieldroasters.com/agent-adapt/device instead.)

Sam sees: the store’s own sign-in page, then Connect your assistant, naming the agent and the address it publishes from, with a tick box per permission, Signed in as sam@…, and the note that access lasts 90 days unless disconnected sooner. Sam presses Allow. You see: the visit is now signed in and attached to Sam’s account. Sam gets an email saying an assistant was connected, with a link to disconnect it.

If Sam were an administrator or shop manager, the page would refuse: staff accounts cannot be connected.

5. The agent reads the order history

It lists Sam’s orders and reads the last one. The store checks on this request, and every later one, that Sam’s approval still stands and that Sam’s account is still eligible. The order is Sam’s, so the agent gets it; an order belonging to someone else would get the same 404 as an order that doesn’t exist.

Sam sees: "Your order #1042 shipped on Tuesday. It was the Colombian, 1 kg." You see: an order-viewed event. Nothing on the order itself.

6. The agent builds the cart

It puts the Colombian back in the cart with the reorder call, or adds it by product ID. The cart is a real WooCommerce cart for this visit, so your prices, sale prices, tax and shipping settings apply. If Sam has a coupon code, the agent applies it and your coupon rules decide.

Sam sees: "That’s £14.50 plus shipping. Shall I get the checkout ready?" You see: cart events against the visit.

7. The agent hands over the checkout

It asks for a checkout link and gives it to Sam. The link works once and lasts 30 minutes.

Sam sees: a link. Opening it in their own browser adds the items and any coupon to their cart there and takes them to your checkout. They pay with your payment methods, as on any other day. You see: an order. Its Origin box names the agent as the source, with medium personal_agent, so it appears in WooCommerce’s attribution reports. The agent’s order count on the Agents screen goes up.

If Sam never opens the link, nothing happens. The link expires and the cart stays with the agent’s visit.

8. Later

Sam’s approval lasts 90 days. Within that time the agent can come back, renew its visit, and check an order or reorder without Sam signing in again. Sam can disconnect it at any moment from My Account → Connected agents, and changing their password disconnects every agent at once. You can block the agent from WooCommerce → Agents, and it is refused from its next request.

What never happens in this story

• The agent never sees Sam’s password. Sam typed it into your sign-in page, not the agent.
• The agent never pays. Sam did, on your checkout.
• The agent never saw another customer’s order.
• Your store sent nothing about Sam to anyone, including to us.

Where Pro changes the story

With Pro, if Sam had asked to cancel a paid order with a refund, the agent would propose it and the store would reply with exact terms ("Cancel order #1042 and refund £14.50 to the original payment method"). Sam would approve those terms, the agent would confirm, and the store would act once. The same applies to return requests and address changes. See Approvals for changes. And if the agent supported MCP instead of the agent API, it would use the same actions as tools through the store’s MCP server.

Common questions

How long does a visit last?

A visit (a Session) ends after 30 days without use; each use extends it. Session Tokens last an hour and the agent renews them silently.

Does the agent keep a copy of my catalogue?

Whatever an agent fetches, it has. The protocol does not let a store control what an agent retains, any more than a website controls a browser. Hidden products are never served in the first place.

What if the customer’s cart on the website already had things in it?

The agent’s cart belongs to the agent’s visit until the customer opens the checkout link. At that point its items are added to the cart in the customer’s own browser; nothing already there is removed. Until the customer opens a link, an agent’s visit never touches their website cart.

Can two agents act for the same customer?

Yes. Each gets its own visit and its own approval, and the customer sees both under Connected agents.