Commerce9 min read

UCP, ACP and AP2: the agentic commerce stack

UCP handles discovery and cart, ACP handles the checkout conversation, and AP2 proves an agent has authority to spend — they stack rather than compete.

They are layers, not rivals

The framing that makes this confusing is treating them as competing standards to pick between. They address different steps of the same transaction.

UCP (Universal Commerce Protocol, from Google and Shopify) covers discovery, cart and orders. An agent fetches /.well-known/ucp to learn what you support. ACP (Agentic Commerce Protocol, from OpenAI and Stripe) covers completing a purchase inside a chat interface, without bouncing the buyer to your site. AP2 (Agent Payments Protocol) covers authority — a signed mandate proving an agent may spend, and how much.

The discovery endpoint

UCP starts at a JSON manifest served publicly at /.well-known/ucp with no auth. It declares capabilities with versions and schema URLs, payment handlers, and checkout endpoints.

json

{
  "ucp_version": "2026-04-08",
  "business": { "name": "Acme Store", "url": "https://acme.com" },
  "capabilities": [
    {
      "name": "catalog.search",
      "version": "1.0.0",
      "schema": "https://ucp.dev/schemas/catalog.search/1.0.0.json",
      "endpoint": "https://acme.com/api/ucp/catalog/search"
    }
  ],
  "checkout": {
    "create": "https://acme.com/api/ucp/checkout/create",
    "update": "https://acme.com/api/ucp/checkout/update",
    "complete": "https://acme.com/api/ucp/checkout/complete"
  },
  "paymentHandlers": [
    { "type": "stripe", "config": { "cardNetworks": ["visa", "mastercard"] } }
  ]
}

What to do first

Complete Product and Offer structured data, before any of the three. It costs the least, it works today with every answer engine, and no protocol rescues a catalog an agent cannot parse.

Then a UCP manifest, because discovery gates everything downstream. Then checkout endpoints. AP2 last — mandates matter once agents are actually transacting with you, not before.

An honest read on timing

These specs are young and moving. Endpoint shapes will change, and an implementation built today will need maintenance.

The durable part is the unglamorous part: machine-readable product data and a stable checkout API. That pays off regardless of which protocol wins, which is a good reason to start there rather than with the newest spec.

Does this apply to your site?

The free checker runs this check and eighteen others, then generates the files to fix whatever fails.

Run the checker