How to Implement the Universal Commerce Protocol in 6 Steps (Complete Technical Guide)

The Universal Commerce Protocol is the standard that makes a product buyable inside Google AI Mode and Gemini. It launched in January 2026 with Google and Shopify behind it, and more than 20 retail partners signed on, including Target, Walmart and Wayfair. Without a UCP implementation, your products are not purchasable on those surfaces. That is the whole reason to do the work. Nothing here asks for a new commerce stack. It asks for an existing one to be exposed in the shape an agent expects, which is a configuration and API problem far more than a rebuild. The prerequisites are ordinary. The unfamiliar part is that a machine, not a person, completes the purchase.

I’ve spent the past week digging through the UCP specification, Google’s integration guide, and Shopify’s engineering documentation. This guide walks you through the complete implementation process, from Merchant Center configuration to production deployment.

Before starting, gather these requirements:

• Google Merchant Center account with products eligible for checkout
• Product data feed with accurate inventory and pricing
• Payment processor integration (Stripe, Adyen, Google Pay, or similar)
• Development environment capable of hosting REST APIs
• Return policy documentation configured in Merchant Center
• Shipping configuration with rates and delivery windows
• Customer support contact information

Time estimate: 1 to 2 weeks for basic implementation, 4 to 6 weeks for full production deployment with Google approval.

Agentic checkout runs on the Merchant Center account you already have, so configuration comes before code. Google gates eligibility at this layer. Until the account carries the required policy and contact settings, its products cannot be checked out on AI surfaces, however well the rest of the integration is built. This is the cheapest step in the guide and among the easiest to leave half done, because a missing setting blocks products rather than breaking anything visible. Account structure matters too. Advanced accounts do not inherit these settings downward the way most people assume, which is worth resolving before you build anything against them.

Why it matters: UCP uses your existing Merchant Center product data to surface inventory in AI Mode and Gemini. Missing configurations will block your products from checkout eligibility. According to Google’s UCP documentation, return policies and customer support information are mandatory Merchant of Record requirements.

How to do it:

1. Log into Google Merchant Center
2. Navigate to Settings > Shipping and returns
3. Configure return policies with: return cost, return window (days), and link to full policy
4. Set up shipping rates for all regions you serve
5. Go to Settings > Business information and add customer support email and phone
6. If using an advanced account, configure policies at each sub-account level

Common mistake: Configuring policies only at the parent account level when using advanced accounts. Each sub-account needs its own return policy configuration.

Eligibility is declared in the product feed. A product enters agentic checkout only if the feed says so, and the recommended way to say it is a supplemental feed layered over your primary data, which stays untouched. Attributes carry the declaration. Regulatory notices ride in the same place, so a product needing a warning does not need a separate system. Feed work is also where product identity gets settled, because the ID an agent quotes has to resolve to the ID your own checkout recognises. That mapping is decided in the feed rather than at runtime, and it is the quiet cause of checkout failures that only appear at the last moment.

Why it matters: Products without the native_commerce attribute will not appear in agentic checkout experiences. The product ID in your feed must also match the ID expected by your Checkout API, or you need to provide a mapping via merchant_item_id.

How to do it:

1. Create a supplemental data source in Merchant Center
2. Add the native_commerce attribute set to TRUE for eligible products
3. Add consumer_notice for products requiring regulatory warnings (e.g., Prop 65)
4. Add merchant_item_id if your checkout system uses different product IDs
5. Upload the supplemental feed and verify products show as checkout-eligible

Example supplemental feed (XML):

<item>
  <g:id>SKU-12345</g:id>
  <g:native_commerce>TRUE</g:native_commerce>
  <g:consumer_notice>
    <g:consumer_notice_type>prop_65</g:consumer_notice_type>
    <g:consumer_notice_message>This product can expose you to chemicals known to the State of California to cause cancer.</g:consumer_notice_message>
  </g:consumer_notice>
  <g:merchant_item_id>checkout-sku-12345</g:merchant_item_id>
</item>

Pro tip: Start with a small subset of products (10 to 20 SKUs) for initial testing. Expand to your full catalog after validating the checkout flow works correctly.

Your business profile is how agents find out you exist. It is a JSON document hosted at a well-known endpoint on your own domain, and it declares what you support and how to talk to your systems. Agents read it at request time, which makes it a live contract rather than documentation. Change it and behaviour changes immediately. Publish it before building the checkout API it points at, so the endpoints you implement later already have a declared home. A profile promising a capability you have not built is worse than a profile that promises less, because an agent will take the promise literally and act on it.

Why it matters: UCP uses dynamic discovery. Agents query your profile to understand what capabilities you offer (checkout, identity linking, order management), which extensions you support (discounts, fulfillment options), and which payment handlers you accept. Without a published profile, agents cannot initiate transactions with your business.

How to do it:

1. Create a JSON file following the UCP profile schema
2. Declare your supported services (start with dev.ucp.shopping)
3. List your capabilities: dev.ucp.shopping.checkout at minimum
4. Add extensions you support: discount, fulfillment, identity_linking
5. Specify payment handlers with public keys for signature verification
6. Host the profile at https://yourdomain.com/.well-known/ucp.json

Example business profile:

{
  "ucp": {
    "version": "2026-01-11",
    "services": {
      "dev.ucp.shopping": {
        "version": "2026-01-11",
        "spec": "https://ucp.dev/specs/shopping",
        "rest": {
          "schema": "https://ucp.dev/services/shopping/openapi.json",
          "endpoint": "https://api.yourstore.com/ucp/"
        }
      }
    },
    "capabilities": [
      {
        "name": "dev.ucp.shopping.checkout",
        "version": "2026-01-11"
      },
      {
        "name": "dev.ucp.shopping.discount",
        "version": "2026-01-11",
        "extends": "dev.ucp.shopping.checkout"
      },
      {
        "name": "dev.ucp.shopping.fulfillment",
        "version": "2026-01-11",
        "extends": "dev.ucp.shopping.checkout"
      }
    ]
  },
  "payment": {
    "handlers": [
      {
        "id": "google_pay",
        "name": "com.google.pay"
      },
      {
        "id": "stripe",
        "name": "com.stripe.payments"
      }
    ]
  }
}

Common mistake: Forgetting to version your capabilities. UCP uses semantic versioning, and agents may behave differently based on the version you declare.

CORS configuration required. AI agents running on Google or OpenAI domains will fetch your business profile cross-origin. Your server must return the appropriate Access-Control-Allow-Origin header, or discovery will fail silently. Configure your CDN or web server to allow requests from agent domains.

This is the part you actually build. The checkout capability is three endpoints and one state machine: create a session, update it as information arrives, complete it once everything required is present. The state machine is the design decision worth understanding. A checkout here is not a form submission that either succeeds or fails. It is a session that moves through defined transitions and can stall, wait for a person, resume, or expire. Your API's job is to report which state a session is in and what would move it forward. Agents do not infer. They read the state you return and act on exactly that.

Why it matters: The checkout capability is the core of UCP. Your implementation must handle the full checkout lifecycle: cart creation, buyer information collection, payment processing, and order confirmation. According to Shopify’s UCP engineering documentation, the protocol models checkout as a state machine to handle both fully automated and human-assisted transactions.

Checkout states:

• incomplete: Missing required information. Agent should resolve via API.
• requires_escalation: Buyer input required. Provide continue_url for handoff.
• ready_for_complete: All information collected. Agent can finalize.
• complete_in_progress: Processing the completion request.
• completed: Order placed successfully.
• canceled: Session invalid or expired.

How to do it:

1. Implement POST /checkout to create a new checkout session
2. Implement PATCH /checkout/{id} to update session with buyer information
3. Implement POST /checkout/{id}/complete to finalize the order
4. Return structured error messages with severity field for agent guidance
5. Include continue_url when human escalation is required

Example checkout response:

{
  "ucp": {"version": "2026-01-11"},
  "id": "chk_abc123",
  "status": "incomplete",
  "line_items": [
    {
      "id": "li_1",
      "product_id": "SKU-12345",
      "quantity": 1,
      "price": {"amount": "49.99", "currency": "USD"}
    }
  ],
  "totals": {
    "subtotal": {"amount": "49.99", "currency": "USD"},
    "tax": {"amount": "4.50", "currency": "USD"},
    "total": {"amount": "54.49", "currency": "USD"}
  },
  "messages": [
    {
      "code": "missing_shipping_address",
      "severity": "requires_platform_input",
      "message": "Shipping address is required"
    }
  ],
  "payment": {
    "handlers": ["google_pay", "stripe"]
  }
}

Step 5 connects your checkout to payment handlers and to the Agent Payments Protocol, known as AP2. AP2 supplies cryptographically verified authorization for agentic transactions. The architecture rests on a separation. Payment instruments are what buyers use to pay. Payment handlers are how those payments get processed. Keeping the two apart has a practical payoff. Your existing payment processor relationships survive the integration. New instruments such as Google Pay become available at the same time. AP2 then adds the consent layer. Its mandate chains carry proof that a user authorized a given transaction. That proof is what fraud prevention and compliance depend on when no human sits at the checkout. This is the step where an agentic checkout stops being a demonstration and becomes something you can charge money through.

Set up payment handler integration using the Agent Payments Protocol (AP2). AP2 provides cryptographically-verified authorization for agentic transactions.

Why it matters: UCP separates payment instruments (what buyers use to pay) from payment handlers (how payments are processed). This architecture lets you keep your existing payment processor relationships while enabling new instruments like Google Pay. AP2 mandate chains provide proof of user consent for every transaction, critical for fraud prevention and compliance.

How to do it:

1. Register your supported payment handlers in your business profile
2. Implement the payment handler callback endpoint
3. Configure AP2 mandate verification using your payment processor’s SDK
4. Store and verify mandate chain signatures before processing payments
5. Handle payment failures gracefully with appropriate error codes

Payment handler negotiation flow:

1. Agent sends profile declaring available instruments (Google Pay, card tokens)
2. Your checkout responds with compatible handlers for the cart
3. Buyer selects payment method and authorizes via instrument provider
4. Agent receives tokenized payment data and mandate chain
5. Your system verifies mandate and processes payment through handler

Security note. You never touch raw card data. Payment handlers provide tokenized credentials. Your system verifies the AP2 mandate chain to confirm user authorization, then passes the token to your payment processor. PCI compliance remains with the payment handler, not you.

Pro tip: If your payment processor handles transactions asynchronously, implement webhooks to update checkout state. The agent may poll your checkout endpoint waiting for the completed status. Your webhook handler should update the session state when the payment processor confirms success.

Step 6 is a gate. Your UCP implementation has to pass conformance testing and clear Google's review before it serves live traffic on AI Mode and Gemini. Google reviews every implementation against its own security and user experience standards. Approval is not a formality you can schedule around. The tests themselves are public. The UCP GitHub repository publishes the conformance suite, and you can run it against your staging environment before anyone at Google reads your code. That ordering is the point. Submitting before testing means fixing the same failures later, with a review clock already running. The rework costs more than the testing would have. Treat conformance as the last engineering task of the build, not the opening task of the launch.

Why it matters: Google reviews all UCP implementations to ensure they meet security and user experience standards. Skipping conformance testing will delay approval and require rework. The UCP GitHub repository provides conformance tests you can run locally.

How to do it:

1. Clone the UCP conformance test suite from GitHub
2. Run tests against your staging environment
3. Fix any failures, paying special attention to error handling and state transitions
4. Test the full checkout flow manually: discovery, cart creation, payment, completion
5. Join the Google UCP waitlist to request review
6. Work with Google’s team to resolve any issues during review

Conformance test categories:

• Profile discovery: Verifies your well-known endpoint returns valid schema
• Checkout lifecycle: Tests state transitions and error handling
• Payment handling: Validates mandate verification and token processing
• Escalation flow: Confirms continue_url behavior for human handoff

Pro tip: Document your implementation decisions. Google’s review team may ask questions about how you handle edge cases like partial inventory, split shipments, or subscription products.

UCP represents the infrastructure layer for agentic commerce. Early implementers will capture AI-driven traffic as Google expands AI Mode and Gemini shopping features. The protocol is designed to work with your existing checkout infrastructure, not replace it.

Start with the core checkout capability. Add extensions (discounts, fulfillment, identity linking) after your basic flow works. The modular architecture means you can expand incrementally without breaking existing functionality.

For how UCP compares to OpenAI’s Agent Commerce Protocol, see my UCP vs ACP comparison guide.

Which step will you start with today?