Glossary
Short, plain-English definitions of recurring terms in this wiki. These entries describe general concepts, not a particular product. Provider-specific meanings stay on the provider pages.
2FA
Two-factor authentication. A second check, besides a password, that a person is who they say they are.
Agentic commerce
Shopping and paying done by an AI agent on a person’s behalf, from finding an item to checking out.
AI Partition
A separately funded slice of an account reserved for an agent, so the rest of the account stays out of reach.
Allowlist
A list of apps or clients that are allowed to connect. Anything not on the list is denied.
API key
A secret string a program uses to prove it is allowed to call a service.
Approval model
The rule for who or what has to say yes before an agent’s order or payment goes through: a person, the provider, limits set in advance, or no one. This wiki sorts brokers into five approval models.
Bearer token
A credential sent with a request, usually in an HTTP header, to prove the client is allowed to access a resource.
CLI
Command-line interface. A program you run by typing commands, rather than clicking in a graphical app.
Client ID Metadata Documents
A way for an app to describe itself with a document at a URL, so a server can identify the app during OAuth sign-in.
Data aggregator
A company that connects apps to a person’s bank and card accounts, with their permission, and passes along data such as balances and transactions.
Dynamic Client Registration
A way for an app to register itself with an OAuth server as part of connecting, instead of being set up in advance by a person.
Environment variables
Named settings stored in the environment of a running program, often used for credentials, endpoints, or limits.
GenAI
Generative AI. Software that produces text, code, or other content in response to a prompt.
Greeks
Standard measures of how an option’s price may change as things such as the underlying price or time to expiration change.
Human in the loop
A design where a person reviews or approves an agent’s action before it takes effect, instead of letting the agent act alone. See Build it for patterns.
llms.txt
A machine-readable index of pages, published so AI agents can find and read a site’s documentation.
Mandates
A record of what a person authorized an agent to do, used so later actions can be checked against that authorization.
MCP
Model Context Protocol. A standard way for an AI application to connect to a tool or service, such as a broker.
OAuth
A standard sign-in method that lets a person grant an app limited access to an account, without sharing their password with that app.
Open banking
Sharing bank data with other apps through approved, permissioned connections, instead of handing over a bank password.
OpenAPI
A standard way to describe a web API, so people and programs can see what requests it accepts.
Paper trading
Practice trading with simulated money. Also called paper mode.
Payment token
A stand-in for a card number or payment method that works only within set limits, such as one seller, a maximum amount or an expiry date. The real card number stays hidden.
PKCE
Proof Key for Code Exchange. An extra check in an OAuth sign-in flow that helps make sure the same app that started the sign-in is the one that finishes it.
Preflight
A preview of an order, including estimated cost or risk, shown before the order is sent.
Protected-resource metadata
A published description of how a server expects a client to sign in, including the sign-in address and the scopes it offers.
Rails
The shared plumbing that agent access to money runs on, separate from any single provider: how agents connect, sign in, prove who they are, carry a person’s consent and pay. See Rails.
Refresh token
A credential an app can use to get a new access token without asking the person to sign in again.
Sandbox
A test environment that is not the live production system.
Scopes
Named permissions in an OAuth sign-in request, which limit what the app is allowed to do.
Stablecoin
A digital token designed to hold a steady value, usually pegged to a currency such as the US dollar.
Stdio
Standard input and output. A local program can talk to a client through these streams instead of over the internet.
UAT
User acceptance testing. A test environment used to try a system before using the live one. See also sandbox.
Virtual card
A card number that exists only online, often created for one purpose and with its own limits.
x402
A protocol for paying for a resource as part of a web request, often used so an agent can pay for data or a service.
Suggest a correction (opens a GitHub issue)