Selling physical goods: payment flows

Lesson rewritten on November 3, 2026 based on the Checkout API reference, the Add UI to your MCP server page, and OpenAI’s Plugin guidelines. The previous version covered selling subscriptions and digital products using invented functions (defineProduct, commerceFlow) and a 30%/15% commission structure without sources. Current plugin rules restrict commerce to physical goods only, and the documentation mentions no commissions. Sources: Checkout API reference · Plugin guidelines.

What you can sell

Start with the rule, because it governs everything else. OpenAI’s publication rules are clear: a plugin can only conduct commerce for physical goods. Selling digital products or services—subscriptions, digital content, tokens, credits—is prohibited, whether directly or indirectly (for example, via a freemium upsell). A list of prohibited goods and services also applies (adult content, gambling, prescription drugs, weapons, tobacco and nicotine, pirated software, misleading financial services, among others). Lesson 13 revisits what a subscription service can still do within these limits.

Within this framework, OpenAI documents three payment flows.

Flow 1: External payment, the default path

External payment is the recommended approach and is available to everyone. The plugin UI presents eligible products, for example with a “Buy” button. When the user decides to purchase, the interface redirects them to a checkout tunnel hosted on your own domain. Pricing, collection, taxes, discounts, shipping, refunds, support, and compliance remain entirely your responsibility. After the purchase, the user can return to ChatGPT with their order confirmation or delivery tracking.

To open this link, ChatGPT provides the window.openai.openExternal({ href }) extension, which opens a controlled link in the user’s browser. You must declare allowed redirect destinations in _meta["openai/widgetCSP"].redirect_domains: the standard _meta.ui.csp policy does not cover this case. For an approved destination, ChatGPT adds a ?redirectUrl=… parameter to the address by default; setting redirectUrl: false prevents this.

function openPayment(cartUrl) {
  if (window.openai?.openExternal) {
    window.openai.openExternal({ href: cartUrl });
  } else {
    // Host lacks this extension: let the user copy the link
    document.querySelector("#payment-link").textContent = cartUrl;
  }
}

The rules are specific: as long as integrated payment is not open to your plugin, external payment is the mandatory path. No other third-party payment solution can be integrated or hosted within the plugin UI.

Flow 2: Previously saved payment methods

For eligible purchases of physical goods, the UI can offer the customer a payment method they have already saved with you. The user selects this method and confirms the purchase within ChatGPT, without leaving the conversation. Your MCP server processes the order and returns the binding confirmation. This flow can display saved payment methods, but it cannot collect new payment details.

Flow 3: The ChatGPT checkout sheet (private beta)

To collect a new payment method within the flow, you need the ChatGPT checkout sheet. This integrated payment feature is in private beta, reserved for specific marketplaces, and is not accessible to all developers or users. Its operation is worth understanding because it illustrates the division of roles between the host and your server:

1. An MCP tool returns a payment session in structuredContent.
2. The component displays items, totals, terms, and shipping options.
3. When the user chooses to pay, the component calls window.openai.requestCheckout(session); ChatGPT opens its checkout sheet.
4. After validation, ChatGPT sends a token representing the chosen payment method to your server’s complete_checkout tool. This tool charges via your payment provider and returns the finalized order—the result the component receives in response to requestCheckout.

The session must contain a unique identifier, items and their quantities, totals in minor currency units (cents, not decimal euros), payment provider and merchant metadata, and mandatory links: terms, privacy, refunds, and support. ChatGPT adds its own fields, such as merchant or conversation_id.

The server is the source of truth

Regardless of the flow, the same discipline applies:

• Prices and order status come from the server, never from a total calculated in the component.
• The payment token is verified, the operation is idempotent—a double-click must not charge twice—the order is recorded, and a reference receipt is returned.
• Cancellation, payment refusal, and provider errors are handled in the component. For the checkout sheet, payment_declined and requires_3ds errors returned by complete_checkout display directly in the ChatGPT sheet.

For the checkout sheet, payment_mode: "test" allows you to test the end-to-end flow with test cards without moving real funds.

Keep useful tools available without a UI

As with the rest of the plugin, the catalog and ordering capabilities must remain accessible via tools usable without a component. The UI serves to present products, prices, terms, and payment choices before confirmation. It does not replace robust data tools, and it never decides on a price.

Key takeaways

• A plugin sells only physical goods: subscriptions, digital content, credits, and freemium upsells are prohibited
• External payment on your domain is the recommended path available to everyone; openExternal opens the link
• Saved payment methods can be offered, not collected
• The ChatGPT checkout sheet (requestCheckout + complete_checkout) is in private beta, reserved for specific marketplaces
• The server is the source of truth: server-side price calculations, idempotent operations, amounts in minor units