UCP: Protocol Hub

When customers complete a purchase through an AI assistant, the checkout must use a common language so platforms, merchants, and payment providers can interoperate. When each integration is custom, you spend more time maintaining connections than growing sales. What happens when every AI surface speaks a different commerce language? You build more one-off integrations instead of scaling. This page is for technical leads, solution architects, and backend engineers implementing the Universal Commerce Protocol (UCP), the open standard for that common language, to enable agent-driven checkout without replatforming. It covers UCP's scope, roles and primitives, discovery and negotiation, REST/MCP/A2A bindings, payment handler patterns, AP2 mandates, and an end-to-end implementation checklist. Example payloads and pitfalls help teams launch faster and stay compliant. The guidance aligns with eLLMo AI's protocol-first, governance-forward approach.

The Universal Commerce Protocol (UCP) is an open standard for interoperable commerce between platforms (apps and agents), businesses (merchants of record), payment credential providers (wallets and identity), and payment service providers. When everyone uses the same discovery and negotiation model, platforms and businesses avoid N×N custom integrations. UCP provides discovery and negotiation via business and platform profiles, standard capabilities (e.g., checkout, order, identity linking) with extensible schemas, transport-agnostic services (REST core; MCP and A2A bindings), and decoupled, handler-based payments with optional AP2 mandates for cryptographic authorization.

References: UCP Core Concepts (ucp.dev); UCP Specification Overview (ucp.dev). Agentic Commerce Protocol Landscape 2025-2026 (eLLMo AI); API-first vs protocol-first for agentic commerce (eLLMo AI).

UCP defines roles (Platform, Business, Credential Provider, PSP), capabilities as the core feature contracts, optional extensions that augment capabilities, transport bindings (REST, MCP, A2A), and payment handlers for tokenization and credential acquisition. When roles and capabilities are explicit, platforms and businesses can negotiate what is supported without guesswork.

Business and platform publish profiles at well-known URIs and declare services, capabilities, extensions, and payment handlers. Each request can include the platform profile (e.g., UCP-Agent header) so the business can intersect capabilities and return the active set. REST is the core binding; MCP and A2A bindings map to UCP capability types for agent-native execution. Payments are separated by role: credential acquisition between platform and credential provider; completion between platform and business; capture between business and PSP. The optional AP2 mandates extension adds cryptographic, non-repudiable proof for autonomous or agent-led transactions.

{
  "ucp": {
    "version": "2026-01-23",
    "services": {
      "dev.ucp.shopping": [
        {
          "version": "2026-01-23",
          "spec": "https://ucp.dev/specification/overview",
          "transport": "rest",
          "endpoint": "https://business.example.com/ucp/v1",
          "schema": "https://ucp.dev/2026-01-23/services/shopping/rest.openapi.json"
        },
        {
          "version": "2026-01-23",
          "transport": "mcp",
          "endpoint": "https://business.example.com/ucp/mcp"
        },
        {
          "version": "2026-01-23",
          "transport": "a2a",
          "endpoint": "https://business.example.com/.well-known/agent-card.json"
        }
      ]
    },
    "capabilities": {
      "dev.ucp.shopping.checkout": [{ "version": "2026-01-23" }],
      "dev.ucp.shopping.discount": [{ "version": "2026-01-23", "extends": "dev.ucp.shopping.checkout" }],
      "dev.ucp.shopping.fulfillment": [{ "version": "2026-01-23", "extends": "dev.ucp.shopping.checkout" }]
    },
    "payment_handlers": {
      "com.google.pay": [{ "id": "gpay_merchant_handler", "version": "2026-01-23" }]
    }
  },
  "signing_keys": [{ "kid": "business_2025", "kty": "EC", "crv": "P-256", "use": "sig", "alg": "ES256" }]
}

Use HTTPS endpoints and avoid trailing slashes on base endpoints. Spec and schema origins must match namespace authority.

POST /checkout-sessions HTTP/1.1
Host: business.example.com
Content-Type: application/json
Authorization: Bearer {token}
UCP-Agent: profile="https://agent.example.com/profiles/shopping-agent.json"

{
  "line_items": [
    { "sku": "SKU-123", "quantity": 1 },
    { "sku": "SKU-456", "quantity": 2 }
  ],
  "shipping_address": { "country": "US", "postal_code": "94105" }
}

Response includes negotiated capabilities and payment handlers (e.g., dev.ucp.shopping.checkout, dev.ucp.shopping.discount, com.google.pay config).

POST /checkout-sessions/chk_123/complete HTTP/1.1
Host: business.example.com
Content-Type: application/json
Authorization: Bearer {token}

{
  "payment": {
    "instruments": [
      {
        "id": "pm_1",
        "handler_id": "gpay_merchant_handler",
        "type": "card",
        "selected": true,
        "credential": {
          "type": "PAYMENT_GATEWAY",
          "token": "{\"signature\":\"...\",\"protocolVersion\":\"ECv2\"...}"
        }
      }
    ]
  },
  "risk_signals": { "session_id": "abc_123_xyz", "score": 0.92 }
}

When AP2 is negotiated, include ap2.checkout_mandate and a payment credential containing a signed payment mandate.

Implementation note: eLLMo AI can act as a protocol gateway: ingest your catalog and policies, normalize into a verified brand graph, and serve UCP, ACP, MCP, and A2A without replatforming. See Solutions for Brands for deployment patterns.

Protocols hub (parent); Integrations hub (stack-first guides); Glossary: Agentic commerce; Blog: API-first vs protocol-first; Blog: Agentic Commerce Protocol Landscape 2025-2026.