AI has changed the way we explore and interact with the digital world. But when it comes to shopping, most are marginalized. You can tell an AI agent that you want to buy a PS5, and it will appear in several online stores. But after that, you can do it yourself – switching tabs, navigating product pages, and filling out checkout forms yourself.

Universal Commerce Protocol (UCP) changes that dynamic. This turns AI agents from passive recommenders into active participants in trading. Rather than just directing you somewhere, an agent can browse, select, and complete the purchase on your behalf. UCP is a standard language that enables interaction between agents and merchants.

By the end of this guide, you’ll understand how UCP works, how agents and merchants connect, how to integrate UCP into your ecommerce stack, and how to implement product discovery, cart management, and checkout flows that actually work in real-world scenarios.

What is UCP?

To understand UCP, start with the gap it fills. If we want real agent trading, AI can’t just browse pages and return links. It’s still a surface level interaction. A structured and reliable way to communicate directly with e-commerce systems and payment providers is needed.

UCP addresses this by defining a standard communication layer between AI shopping agents and online merchants. Rather than guessing how a store works, agents follow a shared protocol.

Now, let’s go deeper and see how UCP actually works in practice.

How does UCP work?

UCP works through the following parts:

• AI shopping agent – This could be an AI you chat with, such as Gemini, ChatGPT, or an agent on Google Search
• Business background – It is an e-commerce platform that has a UCP supported backend
• Communication protocol – UCP defines a vocabulary and acts as an intermediary between two other vocabularies

Let’s dig into how UCP works in practice. We’ll walk through the plot step by step and break down what’s going on under the hood.

Handshake

Before anything happens, AI agents need clarity. Companies must know who their merchants are, what services are available, and how to communicate with them on a technical level.

To get that information, agents retrieve the seller’s Business Profile – a plain JSON document that outlines supported services, capabilities, and endpoints.

We will outline the structure of the UCP Business Profile in more detail later in the article.

Chat to action

Now imagine a shopper typing: “Find me a pair of blue running shoes under $150.”

Agents don’t just search the web. This views the catalog exposed through the Business Profile.

It extracts relevant details from the request – color, category, price limit and compiles them into a JSON payload, and sends it to the seller’s backend.

The backend responds with a structured list of matching products. No scratches. No need to guess.

Manage carts

Once the buyer selects an item, the agent uses it cart_management ability to handle train operations.

It can:

• Add items
• Update quantity
• Delete product

All of this happens through the specified UCP endpoint, keeping session state in sync.

Pay safely

When the buyer is ready to pay, UCP uses Agent Payments Protocol (AP2).

Agents request one-time payment tokens from trusted providers such as Google Pay. The token is created securely and sent to the merchant, who processes the charge through their payment processor.

Agents never handle raw payment credentials directly – everything is tokenized and verified.

How agents and traders connect

Agent trading begins with a handshake between two key documents: Business Profile and Platform Profile.

Let’s break down what each does.

Business Profile

First, Business Profile. This is a JSON file that every trader posts at a standard web address. It provides an overview of which services (such as REST APIs) are running, their capabilities or features, and where to find more information.

Take a look at the example JSON business profile below:

{
  "ucp": {
    "version": "2026-01-23",
    "services": 
      "dev.ucp.shopping": [
        
          "version": "2026-01-23",
          "spec": "<
          "transport": "rest",
          "endpoint": "<
          "schema": "<
        ,
        
          "version": "2026-01-23",
          "spec": "<
          "transport": "mcp",
          "endpoint": "<
          "schema": "<
        ,
        
          "version": "2026-01-23",
          "spec": "<
          "transport": "a2a",
          "endpoint": "<
        ,
        
          "version": "2026-01-23",
          "spec": "<
          "transport": "embedded",
          "schema": "<
        
      ]
    ,
    "capabilities": 
      "dev.ucp.shopping.checkout": [
        
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
        
      ],
      "dev.ucp.shopping.fulfillment": [
        
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
          "extends": "dev.ucp.shopping.checkout"
        
      ],
      "dev.ucp.shopping.discount": [
        
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
          "extends": "dev.ucp.shopping.checkout"
        
      ]
    ,
    "payment_handlers": {
      "com.example.processor_tokenizer": [
        
          "id": "processor_tokenizer",
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
          "config": 
            "type": "CARD",
            "tokenization_specification": 
              "type": "PUSH",
              "parameters": 
                "token_retrieval_url": "<
              
            
          
        
      ]
    }
  },
  "signing_keys": [
    
      "kid": "business_2025",
      "kty": "EC",
      "crv": "P-256",
      "x": "WbbXwVYGdJoP4Xm3qCkGvBRcRvKtEfXDbWvPzpPS8LA",
      "y": "sP4jHHxYqC89HBo8TjrtVOAGHfJDflYxw7MFMxuFMPY",
      "use": "sig",
      "alg": "ES256"
    
  ]
}

In the image above, the business profile specifies the UCP versions it supports. It then goes on to state the transport services for the UCP that it supports: in the example JSON file, REST API, MCP, a2a, and embedded are the supported transport services. There are also endpoints for various transportation methods. Finally, there is a link to the schema that the AI ​​can use when rendering results from the endpoint.

There are also business-backed capabilities. The JSON example above supports checkout, fulfillment, and discounts.

Platform Profile

The Platform Profile defines the tasks the AI ​​agent can perform and the payment methods it can make.

Let’s look at an example JSON file for a platform profile below:

{
  "ucp": 
    "version": "2026-01-23",
    "services": 
      "dev.ucp.shopping": [
        
          "version": "2026-01-23",
          "spec": "<
          "transport": "rest",
          "schema": "<
        
      ]
    ,
    "capabilities": 
      "dev.ucp.shopping.checkout": [
        
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
        
      ],
      "dev.ucp.shopping.fulfillment": [
        
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
          "extends": "dev.ucp.shopping.checkout"
        
      ],
      "dev.ucp.shopping.order": [
        
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
          "config": 
            "webhook_url": "<
          
        
      ]
    ,
    "payment_handlers": 
      "com.google.pay": [
        
          "id": "gpay_1234",
          "version": "2024-12-03",
          "spec": "<
          "schema": "<
        
      ],
      "dev.shopify.shop_pay": [
        
          "id": "shop_pay_1234",
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
        
      ],
      "dev.ucp.processor_tokenizer": [
        
          "id": "processor_tokenizer",
          "version": "2026-01-23",
          "spec": "<
          "schema": "<
        
      ]
    
  ,
  "signing_keys": [
    
      "kid": "platform_2025",
      "kty": "EC",
      "crv": "P-256",
      "x": "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",
      "y": "4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",
      "use": "sig",
      "alg": "ES256"
    
  ]
}

In the platform profile JSON file, the AI ​​agent specifies the UCP versions it understands. It also states the spending capabilities it supports, such as checkout, fulfillmentAnd order. The file lists the payment methods the agent can handle, such as Google Pay and Shop Pay, and includes the public key used to sign its communications.

Real world application

If you want to implement UCP in your ecommerce marketplace, here’s a high-level overview of what you’ll do.

Ability discovery

Discovery is the first step to any UCP integration. This is where the server broadcasts its identity and supported features:

app.get("/.well-known/ucp", (context) => {
    return json({
        business_profile: 
            name: "UCP Demo Server",
            ucp: 
                version: "2026-01-11",
                services:  
                    "dev.ucp.shopping":  endpoint: BASE_URL  
                ,
                capabilities: ["checkout", "order", "fulfillment"]
            
        
    })
})

That /.well-known/ucp The endpoint is where our business profile is located. The AI ​​agent reaches this endpoint to find out where the shopping service is located and what features you have.

Starting a checkout session

The checkout session starts with a cart saving session, buyer information, and discounts:

app.post("/checkout-sessions", (request) => 
    const session = CheckoutService.createSession()

    if (request.body.line_items) session.updateItems(request.body.line_items)
    if (request.body.buyer) session.setBuyer(request.body.buyer)
    
    return json(transformToUCP(session), 201)
)

Unlike traditional APIs that may require a full load up front, UCP allows us to start with an empty session and build it up gradually. We use the service layer to abstract session persistence, returning a protocol-compliant JSON representation to the client.

Integrated update

Rather than separate endpoints for each small change, we use a single endpoint PUT endpoint to synchronize session state:

app.put("/checkout-sessions/:id", (request) =>  session.isClosed()) return error("Session unavailable", 404)
    
    if (request.body.line_items) session.updateItems(request.body.line_items)
    if (request.body.fulfillment) session.updateFulfillment(request.body.fulfillment)
    
    return json(transformToUCP(session))
)

That PUT endpoints handle updates like patches. If a user changes their zip code, we update the fulfillment object; if they add items, we update the cart.

Order completion and transition

Once the session or shopping is complete, we transition from the temporary checkout state to the permanent order object:

app.post("/checkout-sessions/:id/complete", (request) => 
    const session = CheckoutService.complete(id)
    const order = OrderService.createFromCheckout(session)
    
    const response = transformToUCP(session)
    response.order = transformToUCP(order)  
    return json(response)
)

We mark this session as final to prevent further editing and to make the Order permanent.

The response includes final payment status and new order details.

Order management

Once an order is in place, it follows its own lifecycle, primarily focused on picking and canceling:

app.get("/orders/:id", (id) => 
    const order = OrderService.get(id)
    return json(transformToUCP(order))
)

// Endpoint: POST /orders/:id/cancel
app.post("/orders/:id/cancel", (id) => 
    const success = OrderService.cancel(id)
    return success ? noContent() : error("Cancellation failed", 400)
)

After checkout, the interaction moves on to Order source. This endpoint allows clients to track the status of their purchases or initiate cancellations if supported by the merchant’s business rules.

Above is a high level overview of the UCP compliant nodejs backend.

This example illustrates how a server can:

• exposing his abilities
• managing checkout sessions
• transitioning it to permanent order

All while communicating via standard UCP format.

You can find the codebase here.

The UCP is in action

Let’s run through an example from Google to demonstrate how it works.

We’ll run an Agent-to-Agent (A2A) sample, which simulates user interaction with a business through a chat interface.

To run it, make sure you have the following prerequisites installed:

• Gemini API Key
• Python 3.13+ with UV
• Node.js 18+

Set up a business agent

First, clone the sample repo with the following command:

git clone <

Navigate to the business agent directory:

cd a2a/business_agent

Next, install the required Python dependencies using uv

uv sync

Now, create a local environment file from the sample template:

cp env.example .env

Open .env file and add your Gemini API key to GOOGLE_API_KEY variable.

Finally, start the business agent server. This will expose a UCP endpoint that will interact with the chat client.

uv run business_agent

Keep this terminal window open, as the backend server must remain running.

Set up and run the chat client

Open a new terminal window and navigate to the chat client directory:

cd a2a/chat-client

Install the required Node.js packages:

npm install

Once the installation is complete, start the development server:

npm run dev

Please open the link in a browser. In the chat input field, type the following command and press Enter:
“Show me the available stock of cookies.”

Conclusion

UCP represents a real change in how trading works in an AI-driven world.

By introducing a standard way for AI agents to securely discover, interact, and transact with online merchants, UCP brings us closer to a future where shopping feels as easy as having a conversation.

In this guide, we cover the core ideas behind UCP, from the handshake between agents and traders to the mechanisms that enable agent trading. We also dive into a high-level implementation of a UCP-compliant backend in Node.js to see how it all comes together in practice.