UCP and ACP, explained

AI assistants are starting to buy things for people. Two open protocols define how an assistant talks to a store's checkout. This page explains both, how they differ, and what "compliant" actually means.

Agentic checkout What is UCP What is ACP Side by side How a checkout flows The platform profile What ShopReady checks Open questions

What is agentic checkout?

Today a shopper opens a website, adds to cart and types in a card. With agentic checkout, the shopper tells an assistant ("buy the Wool Runners in size 9") and the assistant completes the purchase with the store directly: it finds the product, creates a checkout, fills in shipping, and pays with a token the shopper approved.

For that to work across thousands of stores and many assistants, everyone needs to speak the same language. That's what UCP and ACP are: agreed formats for discovery ("does this store support agents?"), the checkout itself, and payment.

The platform

The AI assistant or app acting for the buyer. It calls the store's APIs. UCP calls this the platform; ACP calls it the agent.

The business

The store (seller, merchant). It stays the merchant of record: its prices, its inventory, its order.

The payment provider

Turns the buyer's approved payment method into a scoped token, so the assistant never handles raw card numbers.

What is UCP?

The Universal Commerce Protocol is an open standard (Apache 2.0) published at ucp.dev, co-developed by Google, Shopify, Etsy, Wayfair, Target, Walmart and others. It aims to cover the whole shopping journey, not only payment: catalog search, carts, checkout, orders, loyalty, even lodging.

Key ideas

Discovery by profile. A store publishes a JSON profile at /.well-known/ucp listing its services, capabilities and payment handlers.
Capabilities with reverse-domain names. dev.ucp.shopping.checkout, dev.ucp.shopping.fulfillment, and vendor ones like dev.shopify.catalog. A capability's schema must be hosted on the domain its name claims (authority binding), so nobody can publish under someone else's namespace.
Several transports. The same operations over REST, MCP (Model Context Protocol, what most AI assistants use), A2A (agent-to-agent), or an embedded checkout in the buyer's browser.
Negotiation. The calling platform sends a link to its own profile; the store downloads it and uses only the capabilities both sides support.
Dated versions. Versions are dates such as 2026-08-25; a store can keep older versions available side by side.

Many Shopify stores already publish a UCP profile and expose checkout, cart, order and catalog tools over MCP. See the directory.

What is ACP?

The Agentic Commerce Protocol is an open standard (Apache 2.0) maintained by OpenAI and Stripe, currently in beta, documented at agenticcommerce.dev. It launched in September 2025 (spec version 2025-09-29) and is focused tightly on checkout between an agent and a seller.

Key ideas

A checkout session API. Five REST endpoints: create, update, retrieve, complete and cancel a checkout_session.
Delegated payment. The agent passes a scoped, single-use payment token, never the card itself.
Strict request rules. A bearer token, an API-Version header and an Idempotency-Key on every POST, with precise rules for retries.
Product feeds and order webhooks alongside checkout, plus newer pieces: carts, extensions, discounts, capability negotiation and an MCP binding.
Discovery. A newer RFC adds /.well-known/acp.json. Most ACP sellers today are connected privately through the agent platform, so few public discovery documents exist yet.

Side by side

	UCP	ACP
Maintained by	UCP authors (Google, Shopify and co-developers)	OpenAI and Stripe
Scope	Whole journey: catalog, cart, checkout, orders, identity, more	Checkout first; feeds, carts, orders added over time
Discovery	`/.well-known/ucp` profile (widely deployed)	`/.well-known/acp.json` (new, rarely deployed)
Transports	REST, MCP, A2A, embedded	REST (MCP binding added in 2026-04-17)
Who is calling?	Platform sends its profile URL; the store downloads and checks it	Bearer token and request signatures
Checkout URL shape	`POST /checkout-sessions`, update is `PUT` (full replace)	`POST /checkout_sessions`, update is `POST` (partial)
Retried request with a different body	`409 Conflict`	`422 idempotency_conflict`
"Same request" means	Identical raw bytes (SHA-256)	Same JSON meaning (key order ignored)
Money	Integers in minor units (2599 = $25.99) in both
Versioning	Date versions in both (UCP `2026-08-25`, ACP `2026-04-17`)

The two protocols disagree on idempotency (the rules that stop a retried "place order" from charging twice). A store that serves both through one shared layer will break one of them. ShopReady tests each side separately.

How a checkout flows (UCP over MCP)

DiscoverThe assistant fetches https://store.com/.well-known/ucp and learns the store's MCP endpoint and capabilities.

Find a productsearch_catalog returns products and their variant ids.

Create a checkoutcreate_checkout with line items; the store returns the authoritative checkout with totals and what's still missing.

Fill in detailsupdate_checkout with the buyer and shipping; status moves to ready_for_complete.

Paycomplete_checkout with a payment token and an idempotency key; the store places the order and returns it.

Retry safelyIf the network drops, the same request with the same key returns the same order, never a second one.

The ACP flow is the same shape over REST: POST /checkout_sessions, POST /checkout_sessions/{id}, then …/complete.

The platform profile

In UCP the store doesn't just check a password. Every request carries a link to the platform profile, a JSON file describing the calling agent, and the store downloads it before answering. If the store can't fetch it, it refuses even read-only calls like catalog search. Shopify enforces this strictly: the file has to be served over HTTPS as application/json with Cache-Control: public.

ShopReady sends its own profile by default. To identify as your own agent, open the Check page, go to Try it → Advanced → Platform profile, choose Use my own profile, and paste its URL. There's a starter profile you can copy, plus the hosting rules merchants enforce.

What ShopReady checks

Discovery (read-only)

Profile reachable over HTTPS without redirects, cache headers, required registries, reverse-domain names, schema authority binding, dated versions, versioned profiles, signing keys, and the MCP tool list.

Checkout behaviour

Create / get / update / complete / cancel; status values; integer money; required fields; errors in the right shape; business errors returned as results, not failures.

Retry safety

Same key replays the same response; a different body is rejected with the right code; a replayed "complete" never creates a second order.

Transport

For MCP: the initialize handshake, JSON-RPC envelopes echoing ids, structuredContent on every result, and required idempotency keys.

Every check cites the section of the spec it comes from, and is marked MUST or SHOULD. Only MUST failures make a store non-conformant.

Open questions in the specs

Building a conformance tool means reading the specs very literally. These came up along the way:

Idempotency differs between UCP and ACP (409 vs 422; raw bytes vs JSON meaning), as described above.
UCP over MCP: "compare the raw body bytes" is hard to apply when every JSON-RPC message carries its own id, so a true retry is never byte-identical.
ACP prose vs schema: the RFC text sends items, while the 2026-04-17 JSON schema requires line_items, currency and capabilities, and the status lists differ.
UCP naming: dev.shopify.catalog has three labels while the convention is {reverse-domain}.{service}.{capability}. Strictly a violation, arguably fine.
Error codes in the wild: when it can't reach a platform profile, Shopify usually answers -32001 profile_unreachable, but sometimes a generic -32603.

Sources: the UCP specification (ucp.dev, version 2026-08-25) and the ACP specification (github.com/agentic-commerce-protocol, version 2026-04-17).