Agentic Commerce Guide for Indonesian Business Websites

Agentic commerce is changing how customers discover and buy products: not only humans clicking through pages, but AI agents that read your catalog, compare prices, and complete checkout on a user's behalf. In 2026, protocols such as OpenAI's Agentic Commerce Protocol (ACP) and Google's Universal Commerce Protocol (UCP) are no longer exclusive to large global merchants. For Indonesian MSMEs and growing businesses building a website beyond marketplaces, the question is no longer whether this shift will arrive — it is which parts of your digital store must become machine-readable first.

This article explains agentic commerce in product terms, which protocols matter for Indonesian merchants, and a minimum technical roadmap so your site is not invisible when shopping agents start routing demand.

1. What Agentic Commerce Is — and Why It Matters for Indonesian SMBs

Agentic commerce describes a pattern where AI assistants act as purchase intermediaries: a user asks for "250g arabica coffee under IDR 80,000 with delivery to Surabaya," and an agent scans merchant data sources, builds a cart, and completes payment without the user opening every site manually.

The key difference from a basic chatbot: the agent does not only answer questions — it executes transactions through structured APIs. A website with attractive HTML but no consistent product data and no programmatic checkout is effectively invisible to these agents.

For Indonesian businesses, pressure comes from two directions. Global platforms (ChatGPT, Google AI Mode, Perplexity) encourage merchants to expose catalogs via standardized feeds and checkout APIs. Local infrastructure is catching up: payment providers such as DOKU have launched Model Context Protocol (MCP) servers that let agents process QRIS and virtual-account payments. If you are already exploring MCP for business AI integration, agentic commerce is the outward-facing side — making your store discoverable and purchasable by external agents.

2. ACP, UCP, and MCP: Which Protocol Should Merchants Care About?

These three acronyms are often conflated. Here is a practical map:

You do not have to pick only one. Serious merchants usually start from shared foundations: structured catalog, real-time stock, clear shipping and return policies, and checkout without brittle manual steps. Specific protocols are layered on afterward.

For most Indonesian SMBs, the realistic priority is becoming agent-compatible — agents can read products and complete orders — rather than enrolling in an ACP beta on day one. That alone improves AI search visibility and local conversational commerce readiness.

3. Machine-Readable Product Data

Agents do not "see" your page design. They consume structured data. Two minimum layers:

Schema.org JSON-LD on product pages. Each SKU needs Product markup with name, description, price (price + priceCurrency: IDR), availability (InStock / OutOfStock), images, and sku. Add an Offer with a url pointing to checkout. This aligns with AI search SEO practices, but in agentic commerce field completeness matters more than keyword density.

A separate product feed. JSON, CSV, or XML updated daily — or in real time if stock fluctuates. The feed must stay in sync with your order database. If you already run omnichannel inventory sync, an agentic feed can be another output channel from the same source of truth.

A common failure mode: feed prices differ from the website, or marketplace stock does not match your owned store. Agents that fail checkout due to inconsistent data do not return — and end users blame your brand, not the agent.

4. Checkout API: Minimum Endpoints for Agent-Completed Transactions

ACP defines a REST pattern you can adapt even before joining OpenAI's merchant program. Core endpoints:

1. Create session — accept SKU list and quantities, return session ID plus initial price summary.
2. Update session — add shipping address, select courier (JNE, J&T, SiCepat), apply discounts if any.
3. Get session state — return authoritative state: line items, tax (Indonesia's 11% VAT where applicable), shipping, total.
4. Complete — process payment and create the order.
5. Cancel — close abandoned sessions.

Responses must be JSON, not HTML. Each step should be idempotent — agents may retry without duplicating orders. Avoid CAPTCHA on programmatic checkout paths; use API keys or signed requests to distinguish approved agents from scrapers.

If you build on a modern stack (Next.js API routes, Laravel, or Supabase Edge Functions), implementing these five endpoints is often lighter than juggling third-party marketplace APIs — and you retain full control.

5. Local Payments: Midtrans, Xendit, DOKU, and QRIS

Global agents often assume Stripe. In Indonesia, checkout must support local methods: QRIS, virtual accounts (BCA, BRI, Mandiri, BNI), and e-wallets (GoPay, OVO, DANA, ShopeePay).

Patterns that work for local agentic commerce:

• Payment links or Snap tokens created via your gateway (Midtrans or Xendit) when the checkout session reaches ready_to_pay.
• Webhooks confirm settlement before marking the order complete — same as a standard website integration, but webhook handlers also update agent session state.
• MCP payment servers (for example from DOKU) let internal company agents invoke payments under explicit permissions; useful for B2B or brands building proprietary shopping assistants.

Avoid hardcoding a single gateway if you plan to grow. A payment abstraction layer — createPayment, verifyPayment interfaces — makes adding providers easier without rewriting checkout APIs.

6. Security, UU PDP, and Agent Boundaries

When agents act on behalf of customers, compliance questions surface quickly. Indonesia's Personal Data Protection Law (UU PDP) requires a lawful basis for processing, privacy notices, and access controls.

Minimum practices:

• Explicit permission scopes — agents may read public catalog data and write orders only after the user authorizes payment.
• Audit trails — log every API call: timestamp, session ID, agent IP or signature, action taken.
• No cross-customer data leakage — checkout endpoints must not return another user's purchase history.
• Data retention — align with policies you already apply for UU PDP on websites and apps.

For small merchants, this is not a reason to delay. Start with rate limiting, mandatory HTTPS, and strict input validation on every endpoint — the same foundation as a website security checklist.

7. MVP Roadmap: Without Shopify, Without Over-Engineering

You do not need a global commerce platform to begin. The sequence we typically recommend for MSMEs and startups in Nganjuk, East Java, and clients across Indonesia:

Phase 1 — Foundation (2–4 weeks). JSON-LD on all product pages. One /api/products.json feed from the same database as your store. Shipping and return policies on static pages that are easy to parse.

Phase 2 — Programmatic checkout (3–6 weeks). Five session endpoints. Payment gateway integration with webhooks. Order notifications to WhatsApp Business for your operations team.

Phase 3 — Agent connectors (optional). Enroll in ACP/UCP programs when volume justifies it, or publish API documentation for local partners. Consider an MCP server if you build a proprietary shopping assistant.

Deliberately defer: complex AI personalization, ML recommendations, and integration with every marketplace chatbot. Focus on clean data and non-brittle checkout — that is what agents need first.

8. Marketplace vs Agent-Ready Website: When the Investment Makes Sense

The most resilient strategy remains hybrid — marketplace for discovery, agent-ready website for margin and data — as discussed in the context of TikTok Shop fee increases. Agentic commerce strengthens the case for an owned site: not only for humans, but for the AI layer that will steer an increasing share of purchases.

Conclusion

Agentic commerce is not hype reserved for global retailers. For Indonesian businesses with an owned website, it is the logical extension of structured SEO, local payment integration, and omnichannel architecture you may already be building. Start with JSON-LD, accurate product feeds, and a simple checkout API — before committing to any specific protocol.

If you want to design an AI-agent-ready website without rebuilding from scratch, start a conversation with us. We help MSMEs and growing businesses in Nganjuk, East Java, and across Indonesia build digital channels that work for humans and machines alike.