OpenAI launches ChatGPT Wallet with biometric purchase approvals

By Olivia Hart

OpenAI introduced ChatGPT Wallet on November 13, 2026, requiring biometric approval before each agent-assisted purchase and using a new payment token after approval. The initial rollout runs through dots to ChatGPT Pro subscribers aged 18 and older in the United States who hold eligible US-issued cards. OpenAI built the wallet with American Express, Mastercard and Visa, and says it keeps actual card details from merchants and agents.

OpenAI reports that 1.2 billion people use ChatGPT each week, many for product research, comparison and purchase decisions. OpenAI says the launch extends ChatGPT from shopping research into transaction completion.

The company says limited availability will help it learn from real-world use while working with businesses, banks and payment networks on compatibility and reliability. In practical terms, OpenAI is testing a supervised checkout layer, not unrestricted agent spending.

How does ChatGPT Wallet authorize each purchase?

OpenAI says users add a card once. Before each purchase, they review the items, total and selected card, then approve with Face ID or a fingerprint scan. Each approval creates a record of what the user authorized, requiring an explicit decision for every transaction.

After approval, the payment network supplies a payment token, a substitute credential containing a card number, security code and expiration date. The selected card is charged without actual card details being shared with the business or agent. OpenAI’s payment documentation calls it the “Payment Account Reference,” allowing merchants to associate the token with the underlying payment account.

OpenAI limits consent to the specific transaction, and its documentation says merchants must not reuse or save the credential for a separate purchase. Recurring billing remains possible when the existing checkout supports it, the customer consents and the merchant follows its processor’s guidance for merchant-initiated transactions.

Cardholders keep their existing rewards and protections for eligible disputes, including defective items, while banks and payment networks continue evaluating transactions. Users still transact directly with businesses, which retain customer relationships and control pricing, fulfillment, returns and customer service.

Merchants remain responsible for order handling and fraud decisions and may keep using a separate authorized card-on-file flow. Wallet changes credential handling, not the merchant’s operating role.

Why do some agent purchases still fail?

OpenAI says ChatGPT Wallet works with existing checkout pages and payment forms without a Wallet-specific integration, although optional compatibility checks can improve reliability. Websites can still block agents inadvertently, while risk systems tuned to detect bots can flag ChatGPT’s cloud browser and fail, decline or cancel purchases.

OpenAI is rolling out support for relaying user signals in the “Forwarded HTTP header.” The available signals include:

• Observed IP address and estimated IP country
• Masked network prefix and autonomous-system number
• User locale and time zone
• Browser or mobile-app details

Signal availability may vary during the rollout. OpenAI is working with fraud-prevention providers Forter, Riskified, Sardine and Signifyd, alongside payment service providers Adyen, Checkout.com and Stripe. Their work aims to make legitimate agent purchases recognizable, but a checkout can process Wallet’s token while its risk controls still reject the transaction.

What must merchants change?

OpenAI’s Commerce Partner Playbook describes a journey that starts with product discovery and comparison before moving to a merchant’s website in a browser or through a plugin. Browser use follows the existing site flow and requires less integration work. A plugin exposes structured actions and lets the business control backend validation and execution.

Merchants can submit current product feeds and check whether their CDN or firewall blocks verified ChatGPT browser visits. They can also integrate Sign in with ChatGPT when an account is required and manage a Business Profile. The payment rail is broadly compatible, but merchant identity and fraud systems remain the operational bottlenecks.

When can agents spend without a purchase-by-purchase check?

Wallet’s initial host is dots, which OpenAI introduced on September 29, 2026 as always-on agents with their own cloud computer and browser. Dots can connect to more than 4,000 apps through plugins. Users control app permissions, review activity and approval requirements, so Wallet adds a payment step to a supervised operating model.

OpenAI expects eventually to let users delegate purchases entirely by setting spending limits, purchase categories or time periods. Those permissions would carry enhanced safeguards built on biometric checks and authorization records. At launch, the agent cannot complete a Wallet purchase without the user’s review and security check, making full delegation a roadmap feature rather than a launch capability.

What determines whether Wallet scales?

OpenAI has separated payment authorization from merchant acceptance, and that distinction sets the launch’s practical limit. The near-term test is whether merchant websites and risk providers consistently accept approved transactions. Broader delegated buying depends on that acceptance, not merely tighter spending controls.