Auth0 ships checkout through someone else's chat window

Auth0 now supports checkout initiated inside a third-party AI assistant. Okta announced the AI Identity for Agentic Commerce toolkit on September 2, alongside an Identity Conversion Suite aimed at the pre-signup half of the funnel. Both reach customers in late September. The interesting part is not the feature list — it is that your login layer is now where agentic commerce either works or quietly breaks.

What actually happened

Okta shipped four things under the Auth0 brand. AI Identity for Agentic Commerce goes generally available in late September; it secures checkout when a customer transacts through a third-party assistant like ChatGPT, and covers brands building their own in-house assistants for recommendations and support. Tenancy-as-a-Service, for self-service multi-tenant configuration and delegated admin, is generally available now.

Two more are in beta and enter early access in late September. The Identity Conversion Suite tracks anonymous visitors before they sign up — browse, add to cart, leave, come back, context intact — and A/B tests signup and login flows against conversion. B2B Connect adds enterprise SSO, federation and multi-tenancy on top of existing identity infrastructure without migrating users, apps or tokens.

Okta cites a projection that AI agents could drive up to 25% of U.S. e-commerce within four years. Treat that as a vendor's framing of the opportunity, not a measured number. The shipping dates are the facts here; the forecast is the sales deck.

Why agentic commerce identity matters for your business

Here is the concrete problem this solves, and it is not abstract. A customer tells an assistant to reorder something. The assistant reaches your store. Who is authenticated — the customer, or a piece of software claiming to act for them? If your stack cannot tell those apart, you have two bad options: block agents entirely and lose the order, or accept the session and inherit the fraud liability.

That decision has been landing on small teams by default, usually as a "why is this bot hitting our checkout" ticket. Vendors turning it into a product is progress, because it means there is finally something to buy instead of something to invent.

Three things to sort out before you buy anything:

Know what your current stack does with agent traffic today. Not what your policy says. Pull the logs. If you cannot distinguish an assistant-initiated session from a browser session, that is the gap, and no vendor can close it for you until you can measure it.

Keep consent as an artifact, not a claim. An agent asserting "the user approved this" is a header. What you want is a signed, storable proof you can produce during a chargeback dispute six weeks later. Ask any vendor exactly what that artifact looks like and where it is stored.

Watch the lock-in shape. Anonymous session tracking is genuinely useful and genuinely sticky — it accumulates pre-signup identity graph inside a vendor's system. Confirm you can export it before you start filling it.

We build checkout flows where the identity decision is a service you can swap, not a dependency baked into the order path. When the third assistant shows up with a fourth protocol, that difference is the whole migration.

Sources: Okta Newsroom, Practical Ecommerce.