# Universal Commerce Protocol (UCP)

> An open-source standard from Google for agentic commerce across the full shopping journey — discovery, cart, checkout, and post-purchase support. Co-developed with Shopify, Etsy, Wayfair, Target, and Walmart, and endorsed by 20+ ecosystem partners including Adyen, Mastercard, Stripe, and Visa. Compatible with A2A, AP2, and MCP. Powers checkout on Google AI Mode in Search and Gemini. Live since January 2026; expanded globally with cart, catalog, and identity-linking capabilities. Google auto-enrolled eligible Shopify merchants in UCP native checkout (September 2026).

> **Unverified draft.** This entry is seeded but not yet verified against primary sources.

## At a glance

| Field | Value |
| --- | --- |
| Name | UCP |
| Layer | agent-communication |
| Category | framework |
| Status | draft |
| Created by | Google |
| Launched | 2026-01 |
| Rails | — |
| Settlement | Delegates payment to pluggable payment handlers (Google Pay, Shop Pay, card processors); UCP standardizes the commerce session, not settlement. |
| Reversible | — |
| Human in loop | optional |
| D2C fit | strong |
| B2B fit | moderate |
| Spec | https://ucp.dev |
| Last verified | 2026-09-28 |

## How it works

UCP is an **open standard** that provides a common language for AI agents, commerce platforms, and payment providers to operate together across the **full shopping lifecycle** — not just checkout. It is surface-agnostic (chat, visual, voice) and industry-agnostic (retail, travel, food, services).

- **Catalog.** Agents search and browse a merchant's product catalog through free-text search, category filtering, and batch retrieval. Merchants expose their inventory via standardized catalog endpoints, enabling price comparisons, back-in-stock alerts, and cross-merchant discovery.
- **Cart.** Multi-item cart building and management across AI surfaces. Shoppers can build a cart in an AI assistant and either complete checkout in-place or **transfer the cart** to the merchant's own site to finish the purchase.
- **Identity Linking.** OAuth 2.0–based account linking lets agents maintain secure, authorized relationships with merchants without sharing credentials, enabling loyalty rewards, order history, and personalized experiences.
- **Checkout.** Supports complex cart logic, dynamic pricing, tax calculations, and multiple payment handlers (Google Pay, Shop Pay, card processors). Merchants remain the **Merchant of Record** with full ownership of customer relationships and data. Payment authorization uses **AP2 mandates** and verifiable credentials.
- **Order Management.** Post-purchase capabilities including real-time order status webhooks, shipment tracking, and return processing across every channel.

UCP is designed for interoperability: it has **A2A, AP2, and MCP** support built in. The specification, SDKs (TypeScript, Python), and conformance tests are hosted on GitHub under the Universal-Commerce-Protocol organization. As of September 2026, UCP powers native checkout for hundreds of thousands of brands in Google AI Mode, Gemini, and YouTube Shopping.

## Tradeoffs

- Google-led governance: while endorsed by a broad coalition, the protocol is primarily developed and operated by Google through Google Merchant Center.
- Merchant-of-record model assumes the merchant handles fulfillment, returns, and customer service — agents facilitate but do not take on transactional risk.
- Cart transfer vs. native checkout creates two distinct merchant experiences with different conversion and control properties; merchants must choose which path to support.
- Auto-enrollment of Shopify merchants (September 2026) inverts the opt-in model — merchants are enrolled by default and must actively opt out.

## Security & limitations

- Payment authorization relies on AP2 mandates and verifiable credentials; the security of agent-initiated purchases depends on the integrity of that authorization chain.
- OAuth 2.0 identity linking is the trust boundary between the agent and the merchant; token leakage or scope over-provisioning could expose account data.
- Native checkout on Google surfaces means payment credentials (Google Pay) are held by Google, not the merchant — a different trust model than traditional e-commerce.

## Fits together with

- a2a
- ap2

## Sources

1. [New tech and tools for retailers to succeed in an agentic shopping era (UCP launch)](https://blog.google/products/ads-commerce/agentic-commerce-ai-tools-protocol-retailers-platforms/) — Google, 2026-01-11
2. [Universal Commerce Protocol — specification and documentation](https://github.com/Universal-Commerce-Protocol/ucp) — Universal Commerce Protocol (GitHub)
3. [Universal Commerce Protocol — official site](https://ucp.dev) — Universal Commerce Protocol

---
_Source: payful.ai — independent editorial reference. Verified 2026-09-28._