UCP

unverified

Universal Commerce Protocol (UCP)

by Google· launched 2026-01verified 2026-09-28

Unverified draft

This entry has been seeded but not yet verified against primary sources. Its details are intentionally incomplete and it is excluded from the machine-readable structured-data claims until verified.

At a glance

Layer
communication
Category
framework
Rails
—
Settlement
Delegates payment to pluggable payment handlers (Google Pay, Shop Pay, card processors); UCP standardizes the commerce session, not settlement.
Reversible
—
Human in loop
optional
D2C fit
strong
B2B fit
moderate
Spec
https://ucp.dev

An open-source standard from Google for agentic commerce across the full shopping journey — discovery, cart, checkout, and post-purchase support. Co-developed with Shopify, Etsy, Wayfair, Target, and Walmart, and endorsed by 20+ ecosystem partners including Adyen, Mastercard, Stripe, and Visa. Compatible with A2A, AP2, and MCP. Powers checkout on Google AI Mode in Search and Gemini. Live since January 2026; expanded globally with cart, catalog, and identity-linking capabilities. Google auto-enrolled eligible Shopify merchants in UCP native checkout (September 2026).

How it works

UCP is an open standard that provides a common language for AI agents, commerce platforms, and payment providers to operate together across the full shopping lifecycle — not just checkout. It is surface-agnostic (chat, visual, voice) and industry-agnostic (retail, travel, food, services).

  • Catalog. Agents search and browse a merchant's product catalog through free-text search, category filtering, and batch retrieval. Merchants expose their inventory via standardized catalog endpoints, enabling price comparisons, back-in-stock alerts, and cross-merchant discovery.
  • Cart. Multi-item cart building and management across AI surfaces. Shoppers can build a cart in an AI assistant and either complete checkout in-place or transfer the cart to the merchant's own site to finish the purchase.
  • Identity Linking. OAuth 2.0–based account linking lets agents maintain secure, authorized relationships with merchants without sharing credentials, enabling loyalty rewards, order history, and personalized experiences.
  • Checkout. Supports complex cart logic, dynamic pricing, tax calculations, and multiple payment handlers (Google Pay, Shop Pay, card processors). Merchants remain the Merchant of Record with full ownership of customer relationships and data. Payment authorization uses AP2 mandates and verifiable credentials.
  • Order Management. Post-purchase capabilities including real-time order status webhooks, shipment tracking, and return processing across every channel.

UCP is designed for interoperability: it has A2A, AP2, and MCP support built in. The specification, SDKs (TypeScript, Python), and conformance tests are hosted on GitHub under the Universal-Commerce-Protocol organization. As of September 2026, UCP powers native checkout for hundreds of thousands of brands in Google AI Mode, Gemini, and YouTube Shopping.

Tradeoffs

  • Google-led governance: while endorsed by a broad coalition, the protocol is primarily developed and operated by Google through Google Merchant Center.
  • Merchant-of-record model assumes the merchant handles fulfillment, returns, and customer service — agents facilitate but do not take on transactional risk.
  • Cart transfer vs. native checkout creates two distinct merchant experiences with different conversion and control properties; merchants must choose which path to support.
  • Auto-enrollment of Shopify merchants (September 2026) inverts the opt-in model — merchants are enrolled by default and must actively opt out.

Security & limitations

  • Payment authorization relies on AP2 mandates and verifiable credentials; the security of agent-initiated purchases depends on the integrity of that authorization chain.
  • OAuth 2.0 identity linking is the trust boundary between the agent and the merchant; token leakage or scope over-provisioning could expose account data.
  • Native checkout on Google surfaces means payment credentials (Google Pay) are held by Google, not the merchant — a different trust model than traditional e-commerce.

See sources below. Documented for commentary and identification only.

Fits together with

  • A2A — Agent2Agent (A2A) Protocol
  • AP2 — Agent Payments Protocol (AP2)

Deployments using UCP

No deployments recorded yet.

Sources

  1. [1]New tech and tools for retailers to succeed in an agentic shopping era (UCP launch)— Google, 2026-01-11
  2. [2]Universal Commerce Protocol — specification and documentation— Universal Commerce Protocol (GitHub)
  3. [3]Universal Commerce Protocol — official site— Universal Commerce Protocol