5 min read
DevWorld 2026: when the buyer is an agent
Stripe told an Amsterdam theatre their checkout flow was already obsolete, then showed the protocol meant to replace it. Notes from two days at DevWorld.
By 
Luca Berton
Amsterdam, 7 and 8 May
DevWorld Conference ran in Amsterdam on 7 and 8 May 2026. The show recorded no episodes there; the host, Luca Berton, attended and took notes. Most of what was said has aged well in the five months since, and one thread has aged into something worth flagging.
The Stripe keynote opened with a line designed to be repeated: “Your checkout flow is already obsolete. You just don’t know it yet.” Then it showed the work behind the claim.
A protocol with a very large council
The Universal Commerce Protocol is pitched as the shared language that lets agents and merchants transact instantly. What makes it worth taking seriously is not the specification, it is the list of names on the tech council.
The demo was deliberately mundane: an agent adds something to a cart, the conversation asks for a shipping address, and the prompt goes back to a box marked Backend, Tool, LLM. Nothing futuristic on screen, which is the point — the interface the buyer sees is a chat, and the commerce machinery has to live behind it.
The payment problem, stated plainly
The piece that deserves attention from anyone building platforms is the shared payment token. A buyer authorises their agent once; the agent is issued a token; the token is shared with each merchant, who uses it to generate a PaymentIntent in their own account. One authorisation, many sellers.
Read that next to what Stockholm was arguing in October and the shape of the problem becomes obvious. Nordic APIs spent three days on how an API verifies an agent it has never met, how delegation is made explicit, and how spend is capped. Here is the commerce industry shipping delegation with a payment instrument attached, backed by ten of the largest companies on the internet, five months earlier.
The host’s own UnConference card in Stockholm asked for exactly this topic — agentic commerce, UCP, shared payment tokens — to be discussed, because the identity people and the commerce people were solving the same problem without meeting. DevWorld is the evidence that one side had already shipped.
Day two had a colder message
The second day pulled against the first, and the organisers were right to let it. A talk titled Building Got Easier, Growth Got Harder made the argument that the collapse in the cost of building a product has not been matched by any collapse in the cost of getting anyone to use it.
A companion session put it less gently — just AI is not enough, yet, to create a company. For a conference whose first day was a protocol launch backed by Amazon and Google, that is a healthy amount of self-contradiction to hold in one venue.
The rest of the two days
Tailscale’s Lee Briggs gave the other keynote, on what an AI operating system looks like. Checkmarx made the application-security argument that matters most in a year of generated code: discovery got easier and exploitation got faster at the same time, and AI scanning on its own mostly produces noise, so the working answer is hybrid rather than wholesale replacement. And an infrastructure keynote laid out six pillars under a slogan that is at least honest about the business model: you build the intelligence, we handle the messy maintenance underneath.
The thread
DevWorld in May was the earliest of the five conferences the show has written up this season, and in hindsight it was the one that showed the agent problem with money already attached. Red Hat put agents inside the platform. PlatformCon said the harness matters more than the model. RoachFest drew an agent layer over the database. Nordic APIs asked who the agent is.
DevWorld had already handed it a wallet.
Where to read more
The host’s notes on lucaberton.com:
- Agentic commerce: UCP and the agent demo, slide by slide.
- Stripe’s machine payment protocol and Tailscale, the two keynotes.
- Day two: building got easier, growth got harder.
- Checkmarx: AI is not enough for AppSec.
- The AI infrastructure keynote.
Next
New episodes every Tuesday, on YouTube first, then Apple Podcasts, Spotify and Amazon Music; every platform is listed on the home page.
Built something the rest of us run on? Being a guest is free: how it works.
Built something the rest of us run on? Being a guest is free. Take the other chair