Google Pay

The agent can't 'authorize' Google Pay. The only OAuth here is Google identity (openid email profile). Payment data comes from the Google Pay API payment sheet, keyed by a merchant ID, and is gated by console review, not scopes. Write that down before coding — it changes the whole design.

Pick Gateway (participating PSP) or DIRECT (PCI DSS). Gateway is the low-friction path. Have the agent draft the memo with the gateway name and the console integration type so the human reviewer sees consistency.

GOOGLE PAY — INTEGRATION DECISION
Goal: agent-adjacent checkout (no OAuth data access requested)
Path: Gateway tokenization
- Gateway: <PSP from Google's table>
- Integration type in console: Gateway
- OAuth scopes requested: none (Google Pay has none)
- Identity (optional, separate project): openid, email
- Production gate: Google Pay & Wallet Console website review
- Out of scope: reading user's saved cards/transactions (no documented API)

Google Pay & Wallet Console → Type of business: Merchant → complete Business Profile → Google Pay API tab → Get Started → accept ToS and Acceptable Use Policy. Merchant ID appears top-right. Requires your login and legal acceptance — not delegable.

“Accept the Google Pay Terms of Service and Acceptable Use Policy.” — [S9] verified verbatim

Follow tutorial steps 1-9: declare apiVersion 2/0, set the gateway tokenizationSpecification, list allowed card networks/auth methods, load pay.js, call isReadyToPay() before rendering the button, build PaymentDataRequest, call loadPaymentData() synchronously in the click handler. The agent can write all of it.

“Follow the steps in this tutorial to integrate a web application with the Google Pay API, and to configure it to accept payment cards.” — [S4] verified verbatim

const baseRequest = { apiVersion: 2, apiVersionMinor: 0 };

const tokenizationSpecification = {
  type: 'PAYMENT_GATEWAY',
  parameters: { gateway: 'example', gatewayMerchantId: 'YOUR_GATEWAY_MERCHANT_ID' }
};

const paymentsClient = new google.payments.api.PaymentsClient({ environment: 'TEST' });

const paymentDataRequest = {
  ...baseRequest,
  merchantInfo: { merchantName: 'Example Merchant' },
  allowedPaymentMethods: [{
    type: 'CARD',
    parameters: {
      allowedAuthMethods: ['PAN_ONLY', 'CRYPTOGRAM_3DS'],
      allowedCardNetworks: ['AMEX', 'DISCOVER', 'INTERAC', 'JCB', 'MASTERCARD', 'VISA']
    },
    tokenizationSpecification
  }],
  transactionInfo: { totalPriceStatus: 'FINAL', totalPrice: '12.34', currencyCode: 'USD' },
  emailRequired: true
};

Run the integration checklist: risk/3DS parity for PAN_ONLY, brand assets and button sizing, button only after isReadyToPay(), no pop-up blocking, cards-on-file test, Android device-token test, shipping/email parsing. Test on Chrome, Firefox, Safari, Edge, Android and iOS.

“Use the following checklist to ensure you've completed all the required steps in your web integration.” — [S7] verified verbatim

Only if you truly need the user's Google identity: register a Web application OAuth client in the Cloud Console, set an authorized redirect URI (http://localhost:8080 works for testing), keep client_secret.json out of the repo, and request the narrowest scopes. Separate test and production projects. This yields an ID token, not payment access.

“For testing, you can specify URIs that refer to the local machine, such as http://localhost:8080.” — [S1] verified verbatim

Console → Google Pay API > Integrations > Integrate with your website > Add website. Give the top-level domain, select Integration type Gateway (or Direct), upload screenshots of the working Google Pay flow, Save, then Submit for approval. AI gives instant screenshot feedback; a human makes the final call.

“In the Google Pay & Wallet Console, navigate to Google Pay API > Integrations > Integrate with your website section and click Add website.” — [S9] verified verbatim

Set merchantInfo.merchantId from the console, initialize PaymentsClient with environment 'PRODUCTION', and ship. No OAuth token exchange, no scope verification, no consent-screen review is involved on the Pay side.

“Initialize PaymentsClient with an object that includes an environment property set to 'PRODUCTION'.” — [S9] verified verbatim

If you went DIRECT: rotate the public encryption key annually and submit PCI Attestation via the Google Pay & Wallet Console, from a QSA or third party. Gateway integrators skip this entirely.

“If you complete a DIRECTtokenizationSpecificationtype integration, you must annually rotate your public encryption key and provide PCI Attestation to Google using the Google Pay & Wallet Console.” — [S7] verified verbatim