The Universal Commerce Protocol (UCP) is an open standard, co-developed by Google and Shopify with Etsy, Wayfair, Target, and Walmart, that defines how AI agents discover and transact with merchants across the full shopping journey. Sundar Pichai announced UCP at the National Retail Federation's NRF 2026 keynote on January 11, 2026, with backing from a coalition of more than 20 retailers, payment networks, and processors. The specification ships on GitHub under Apache License 2.0, and the protocol is already wired into Google's AI Mode in Search and the Gemini apps, where U.S. shoppers can buy from participating retailers without leaving the chat. UCP is one of three protocols competing to standardize agent commerce in 2026; this article walks through how UCP works in detail, who is behind it, how it composes with AP2 and the Model Context Protocol, and where the open questions still are.
​

The Universal Commerce Protocol is an open specification, co-developed by Google and Shopify, that defines how AI agents discover products, negotiate capabilities, run checkout, and exchange post-purchase data with merchants. UCP launched January 11, 2026 under Apache License 2.0 and is wired into Google AI Mode plus the Gemini apps and Microsoft Copilot Checkout for 20-plus participating retailers.
​

UCP is a protocol specification for agent-driven commerce. It covers four operational stages — product discovery, capability negotiation, checkout, post-purchase handoff. Rather than each merchant building a one-off integration with each AI surface, a UCP-compliant merchant publishes a single capability profile that any compliant agent can read and act on. Google's technical post describes UCP as enabling "seamless commerce journeys between consumer surfaces, businesses, and payment providers" (the protocol's own framing) and built to work with existing retail infrastructure rather than replacing it.
​

The protocol's stated goal is to be the agent-commerce equivalent of HTTP for the web: an open base layer that anyone can implement. According to Vidhya Srinivasan, Google's VP and GM of Ads and Commerce, UCP "sits between agentic experiences with consumer services on one hand and the business back-end on the other." Pichai used three words to characterize it during his NRF remarks: open, agnostic, and "available starting today."
​

Two parts of the design make UCP distinct from earlier agent-commerce protocols. First, it covers the full journey rather than one transaction step. Second, it is composable: UCP defines the conversation shape, but plugs into Agent Payments Protocol (AP2) for payment authorization, the Model Context Protocol (MCP) for tool access, and Agent-to-Agent (A2A) for cross-agent delegation. A merchant can support all four side by side. The competing OpenAI Agentic Commerce Protocol (ACP) bundles checkout and payment together via a Shared Payment Token; UCP separates the two and composes with whichever payment protocol the merchant prefers.
​

UCP was launched as an open standard rather than a proprietary integration. The reference repository sits at github.com/Universal-Commerce-Protocol, and Shopify, Etsy, Wayfair, Target, and Walmart are listed as co-developers in Google's January 2026 announcement. Anyone can submit pull requests; the protocol is governed under an Apache 2.0 license rather than a vendor-controlled spec.
​

UCP uses a three-tier architecture: a transport-level shopping service at the bottom, capabilities like Checkout and Identity Linking in the middle, and reverse-domain-named extensions on top. An agent fetches a merchant capability profile from a well-known discovery URL, then invokes the relevant capability over REST, JSON-RPC, MCP, or A2A.
​

UCP works through three architectural primitives that Shopify's engineering team described in its UCP design post: a shopping service for low-level transport, capabilities for major functional areas, and extensions for domain-specific schemas. The team described monolithic protocols as failing predictably ("too rigid to adapt, too slow to evolve") and chose a layered design specifically to avoid that fate.
​

The first interaction a UCP agent has with any merchant is a discovery call. The agent fetches the merchant's capability profile at the well-known URL /.well-known/ucp, which returns a JSON manifest listing every capability the merchant supports, the version of each, and any extensions that augment them. The UCP core-concepts doc calls capabilities "the verbs of the protocol" and names four canonical ones at the launch version: Checkout, Identity Linking, Order, and Payment Token Exchange. Extensions use a reverse-domain naming convention (e.g., com.loyaltyprovider.points) so that any organization can extend the protocol within its own DNS namespace without a central approval committee.
​

Once the agent has read the capability profile, the agent and merchant compute the intersection of what the agent needs with what the merchant supports. If a buyer asked for a product, the agent queries the Catalog capability. If the buyer is ready to purchase, the agent invokes Checkout. UCP's negotiation layer dynamically adjusts based on cart contents, buyer location, and transaction size — most consequentially for selecting which payment handler will run.
​

Every UCP request carries four mandatory headers: UCP-Agent identifies the agent making the call, request-signature carries a cryptographic signature, idempotency-key protects against duplicate submissions, and request-id provides traceability. A checkout-session payload carries structured data for line items (id, quantity, totals), buyer details (full name, email), currency, payment handlers and instruments, and any discount codes with calculated allocations. The format is JSON; the transport is agnostic — UCP runs over REST, JSON-RPC 2.0, MCP, or A2A depending on the deployment.
​

A worked example clarifies the choreography. Suppose a U.S. shopper asks Gemini, "Find me a navy weekender bag under $250." The agent issues a search across Shopify's UCP-compliant Catalog capability and returns a list of matching products from Monos, Everlane, and Pura Vida (three of the brands Shopify named as launch participants). The shopper picks the Monos bag. The agent then opens a Checkout capability call with the Monos store, including the buyer's shipping address from Google Wallet and a payment handler request for Google Pay. UCP exchanges the transaction details; AP2 supplies the user-consent mandate authorizing the payment; the merchant verifies both signatures, runs the payment, and returns an order confirmation. The merchant remains the merchant of record, and the relationship survives the agent — the buyer can return the bag through Monos's normal channel.
​

UCP also covers the human-in-the-loop edge case. A sub-protocol called the Embedded Checkout Protocol (ECP) opens a JSON-RPC 2.0 channel when a transaction step requires human input — a 3DS challenge, an identity verification request, a manual approval — and hands control back to the agent once the human step completes. ECP exists because a small but persistent fraction of agent transactions will always need a human in the loop, and the protocol designers chose to make that an explicit primitive rather than a workaround.
​

The UCP coalition includes 5 co-developers (Shopify plus Etsy, Wayfair, Target, Walmart) and 20-plus endorsing partners spanning card networks (Visa, Mastercard, Amex), processors (Stripe, Adyen), and major retailers like Best Buy and Home Depot. Active retailer pilots run through Brand Agent and Direct Offers. Geographic depth concentrates in North America and Western Europe at launch.
​

The UCP launch coalition is the most concrete evidence of its commercial scope. Google's January 11, 2026 announcement named co-developers and endorsers in three categories — co-developers, endorsing partners, and active retailer pilots — that span retail, payments, and platform tooling.
​

Five organizations built UCP alongside Google and are described as co-developers: Shopify, Etsy, Wayfair, Target, and Walmart. Shopify's involvement is the load-bearing one — most non-Shopify merchants will inherit UCP support through Shopify's "Agentic Storefronts" feature, which manages UCP integrations centrally from Shopify Admin. Shopify also published its own technical UCP write-up in parallel with Google's.
​

The 20-plus endorsing partners cover the payments and merchant sides of the stack. Payment networks at launch include Visa, Mastercard, and American Express; payment processors include Stripe and Adyen; merchants include Best Buy, The Home Depot, Macy's Inc., Flipkart, and Zalando. Brands selling through Shopify's UCP integration at launch include Monos, Gymshark, Everlane, Keen, and Pura Vida — each available through Google AI Mode, Gemini, and Microsoft Copilot Checkout.
​

Two Google products are already shipping on top of UCP. Brand Agent went live with Lowe's, Poshmark, and Reebok at launch. Direct Offers, which lets brands offer targeted discounts during agent product recommendations, includes Rugs USA, Petco, e.l.f. Cosmetics, Samsonite, and Michael's among Shopify-merchant pilots. Tobi Lütke, Shopify's CEO, framed the use case in a quote in Google's announcement: "This kind of serendipity is where the best of commerce happens" — describing agents matching products to specific customer interests in ways static search cannot.
​

Two gaps deserve note. WooCommerce — the open-source e-commerce platform powering roughly a third of all online stores — was not part of the launch. Smaller direct-to-consumer brands without a Shopify, BigCommerce, or comparable backend remain invisible to UCP-equipped agents until their platform integrates. And no major Asia-Pacific retailer outside Flipkart and Zalando appeared in the launch list, which leaves UCP's geographic coverage thin outside North America and Western Europe at the start.
​

UCP, ACP, and AP2 differ in scope rather than function. UCP defines the full agent-merchant journey; ACP defines the checkout conversation and bundles payment via Shared Payment Token; AP2 supplies the cryptographic mandate proving user authorization. UCP composes with AP2 cleanly, overlaps with ACP at the checkout step, and runs alongside MCP for tool transport.
​

UCP is one of three actively used agent-commerce protocols in 2026, and the differences are most usefully thought about as differences in scope rather than competitive overlap. A side-by-side comparison of the agent-payment protocols walks through this in more depth; the table below distills the core distinctions.

UCP and AP2 are designed to compose. UCP defines the request and response shape for the checkout session; AP2 supplies the cryptographic mandate that proves the user authorized the payment. A merchant receives a UCP checkout request with an AP2 mandate attached; the merchant verifies the merchant-side checkout schema and the user-side payment authorization in one pass. Google's developer documentation calls UCP "compatible with Agent Payments Protocol (AP2)" and explicitly lists AP2 alongside MCP and A2A as standards UCP composes with.
​

UCP and ACP, by contrast, overlap. Both define a checkout call. ACP bundles the payment in via the Shared Payment Token, while UCP defers the payment to AP2 (or any other compliant handler). They are not mutually exclusive: a Shopify merchant can implement both, exposing UCP for Google AI Mode and Gemini and ACP for ChatGPT. The pragmatic reality is that most large retailers are integrating both and will let the AI surface choose the one it speaks. Etsy, Walmart, and Target have all integrated both ACP and UCP.
​

MCP plays a different role. The Model Context Protocol, open-sourced by Anthropic in November 2024 and donated to the Linux Foundation's Agentic AI Foundation in December 2025, is the layer over which agents discover and call tools in the first place. UCP can be transported over MCP — that is one of the four named transports in the spec — but UCP doesn't replace MCP. They sit at different altitudes: MCP is the data plane for agent-to-tool calls; UCP is the schema for one specific class of tool (commerce). An agent that runs MCP for general tool access can use UCP as the payload format for its commerce calls.
​

UCP's technical core is a layered design: independently versioned capabilities, opt-in extensions bound by reverse-domain naming, and four mandatory request headers (UCP-Agent, request-signature, idempotency-key, request-id) carrying agent identity, body signature, replay protection, and trace IDs. The discovery JSON manifest lists every capability, version, schema URL, and supported payment handler in one call.
​

UCP's three-tier architecture deserves close inspection because the architectural choices make the difference between a protocol that scales and one that ossifies. The shopping service sits at the bottom and handles transport-level concerns. Capabilities sit in the middle as the protocol's "verbs." Extensions sit on top as opt-in schemas that add domain-specific functionality.
​

Capabilities are independently versioned. A merchant supporting Checkout v2 can interoperate with an agent that speaks Checkout v1 as long as the underlying schema overlap remains valid. This is the same versioning discipline that kept HTTP usable through three major revisions; UCP's designers explicitly cite that lineage in the Shopify engineering post. Each capability is a self-contained schema, and the GitHub repo organizes one directory per capability with separate version subfolders.
​

Extensions are where the protocol's open-ended growth lives. An extension is bound to a parent capability via the extends field. The reverse-domain naming convention (com.loyaltyprovider.points) means that namespace ownership follows DNS — a merchant who controls a domain controls the corresponding extension namespace. The Shopify team described this as eliminating "central approval committees" in favor of letting any organization publish its own extensions. The trade-off is that without a central registry, agents have to trust extension implementations on a per-merchant basis.
​

Header semantics deserve a closer look. UCP-Agent identifies the agent making the call by some agreed-on identity scheme (typically a public-key fingerprint or Visa TAP signature). request-signature covers the entire request body and headers; merchants verify it before processing. idempotency-key is the standard pattern for replay protection — a duplicate request with the same key returns the same response without re-executing the transaction. request-id is a unique UUID for tracing across services.
​

The discovery JSON manifest at /.well-known/ucp is the single integration surface every merchant has to expose. The manifest lists each capability with a name, a version, and a JSON Schema URL. Extensions appear as separate entries with the parent capability declared. Payment handlers are listed with their configurations — for example, a Stripe payment handler will list which card networks and digital wallets it accepts, while a Coinbase handler might list supported chains and stablecoins. An agent can read the manifest in one call and have everything it needs to plan a transaction.
​

The spec is licensed under Apache 2.0, which means anyone can fork and modify it, and contributions flow through the standard pull-request process. The Universal-Commerce-Protocol GitHub organization hosts the spec, samples, and reference implementations. As of April 2026, the repo had several thousand stars and a few hundred forks, with active issue and pull-request traffic — a healthy early-protocol footprint.
​

UCP's main open questions in 2026 are platform dependence on Google's agent surfaces, composition complexity from stacking UCP with AP2 and MCP, weak coverage for long-tail merchants outside Shopify and BigCommerce, governance ambiguity (Apache 2.0 with Google as dominant contributor, no Linux Foundation handover yet), and unresolved 2026-era consumer-protection rules for autonomous-agent transactions on card rails.
​

UCP solves real problems and creates new ones. The trade-offs are worth tracking because they shape which merchants will benefit and which will be left behind.
​

The first open question is platform dependence. Although UCP is open-source under Apache 2.0, the gravitational center is Google's AI Mode and Gemini. A merchant that integrates UCP today is integrating to be discoverable in Google's agent surfaces. If those surfaces lose share to ChatGPT (which runs ACP) or Anthropic's Claude (which runs MCP-based shopping experiences), UCP's reach contracts. The protocol is technically neutral; the deployment reality is not.
​

The second is composition complexity. UCP composes with AP2, MCP, and A2A. Each composition surface adds verification logic at the merchant. A merchant verifying a UCP-plus-AP2 transaction has to validate the UCP request signature, check the AP2 mandate signature, run the payment handler, and return a UCP response — four cryptographic steps where ACP's Shared Payment Token has one. The benefit is flexibility; the cost is implementation surface area.
​

The third is the long-tail merchant. UCP requires a merchant to publish a capability profile and implement at least one capability handler. Merchants on Shopify get this for free through Agentic Storefronts; merchants on WooCommerce, Magento, or custom stacks have to build their own integration or wait for a vendor to ship one. The result is that UCP-enabled commerce is concentrated among Shopify, BigCommerce-tier platforms, and the largest enterprise merchants. Long-tail merchants without a UCP integration remain invisible to UCP-equipped agents.
​

The fourth is governance. UCP's GitHub repo is governed under Apache 2.0 with Google as the dominant contributor. The Linux Foundation's Agentic AI Foundation, which now houses MCP, has not yet absorbed UCP. The question of whether UCP follows MCP's path into a neutral foundation is open, and the answer matters for long-run adoption by competitors who would rather not be dependent on a Google-controlled spec.
​

The fifth is regulatory. Card networks operate under disclosure rules, dispute timelines, and statutory consumer protections that long predate autonomous software buyers. UCP introduces a new actor (the agent) into the buyer-merchant relationship; chargeback and dispute rules were not written with autonomous agents in mind. The pragmatic answer so far has been to keep the merchant as the merchant of record, but consumer protection regulators are starting to pay attention, and the long-run regulatory footprint is unsettled.
​

UCP integration pays back fastest for merchants meeting one of three criteria: meaningful AI-channel referral traffic, multi-surface agent exposure across Google AI Mode plus Gemini and Microsoft Copilot Checkout, or B2B procurement workloads where agents transact at scale. Shopify merchants get UCP through Agentic Storefronts; custom-stack merchants build a 1-page manifest plus a checkout handler.
​

UCP integration is worth the engineering investment for merchants who meet at least one of three criteria.
​

The first is sufficient AI-channel traffic. Adobe Analytics measured a 4,700% year-over-year jump in generative-AI traffic to U.S. retail sites between July 2024 and July 2025. Merchants seeing meaningful AI-referred traffic in their analytics have a clear case for UCP integration; merchants whose audience still arrives through paid search and direct have a weaker one.
​

The second is multi-channel agent exposure. A merchant that wants to be discoverable in Google AI Mode, Gemini, and Microsoft Copilot Checkout simultaneously gets all three through one UCP integration; the Shopify Agentic Storefronts product makes this concrete. Merchants with high SKU diversity (Etsy is the canonical example) benefit disproportionately because agent surfaces excel at long-tail discovery in ways static search does not.
​

The third is a B2B or specialty use case where AI procurement is plausible. Office-supply reordering, SaaS subscription management, and specialty industrial-supply purchasing are categories where enterprise-side agents can transact at scale. UCP's composition with AP2 means a procurement agent can verify a corporate-policy mandate in the same call as the checkout request, which fits the B2B workflow more naturally than ACP's consumer-card-token approach.
​

The integration itself is moderate. A merchant on Shopify implements UCP through a managed feature flag inside Agentic Storefronts. A merchant on a custom stack reads the spec on GitHub, exposes a /.well-known/ucp manifest, and implements at least the Checkout capability. Adyen and Stripe are both UCP endorsing partners building payment-handler integrations, which lowers the payment-side implementation cost. The closest analog is implementing OAuth or webhooks: more than a weekend, less than a quarter, with the hardest part being the test matrix rather than the spec itself.
​

Sources and methodology. UCP specifications verified against Google's official UCP announcement and developer documentation. Coalition partner roster from primary press releases. Adobe AI traffic figures from Adobe Analytics. Figures refresh quarterly.
​

UCP defines the agent-merchant conversation; AP2 authorizes payment; neither protocol specifies the rail. Most UCP transactions settle on cards, but cross-border B2B agent payments and machine-to-machine workloads increasingly settle in stablecoins. Eco operates a stablecoin execution network across 15 chains, abstracting solver selection so an agent paying USDC on Base can transact with a counterparty whose treasury sits elsewhere.
​

UCP defines how an agent talks to a merchant. AP2 defines how the user authorizes the payment. Neither protocol specifies the rail across which dollars actually move. Most UCP transactions today settle on card rails through Stripe, Adyen, Visa, Mastercard, or American Express — every one of those is an endorsing partner at the launch coalition. A growing share will settle in stablecoins for cross-border B2B agent payments and machine-to-machine workloads where card economics break. Eco operates as a stablecoin execution network across 15 chains, abstracting solver selection and routing so that an agent paying in USDC on Base can transact with a counterparty whose treasury sits on Solana, Arbitrum, or Tron. UCP and AP2 handle the protocol-level conversation; cross-chain orchestration handles where the dollars settle when the payment crosses chain boundaries, and intent-based routing turns a single agent payment into a deterministic settlement across the right chain. The two layers are complementary, not competing. For builders deploying agent flows, the practical division is clear: UCP for what gets bought, AP2 for who authorized it, and a stablecoin execution network for the actual money movement when card rails do not fit.
​