How to Implement the Universal Commerce Protocol

• Sign up for UCP access at developers.google.com/merchant/ucp. You need an active Google Merchant Center account.
• Configure your shipping settings, return policies, and product feed. Enable the native_commerce attribute on products eligible for AI checkout.
• Add conversational commerce attributes: product Q&As, compatible accessories, substitutes, and specific descriptors (e.g. "dark purple" not just "purple").

• Create a JSON file at https://yourdomain.com/.well-known/ucp (per RFC 8615). This is how AI agents discover your commerce capabilities.
• The manifest declares your services (shopping), capabilities (checkout, fulfillment, discounts), payment handlers (Google Pay, Shop Pay), and signing keys.
• Set CORS headers: Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET, OPTIONS, and Content-Type: application/json.

{
  "ucp": {
    "version": "2026-01-23",
    "services": {
      "dev.ucp.shopping": [{
        "version": "2026-01-23",
        "transport": "rest",
        "endpoint": "https://yourstore.com/ucp/v1",
        "schema": "https://ucp.dev/2026-01-23/services/shopping/openapi.json"
      }]
    },
    "capabilities": {
      "dev.ucp.shopping.checkout": [{
        "version": "2026-01-23",
        "spec": "https://ucp.dev/specification/checkout/"
      }]
    },
    "payment_handlers": {
      "com.google.pay": [{
        "version": "2026-01-23",
        "config": {
          "merchant_id": "YOUR_GOOGLE_PAY_MERCHANT_ID",
          "allowed_payment_methods": ["CARD"],
          "allowed_card_networks": ["VISA", "MASTERCARD", "AMEX"]
        }
      }]
    }
  }
}

• AI agents rely on JSON-LD structured data to understand your products. Add Product schema with Offer, brand, GTIN, images, availability, and shipping details.
• Critical: Always set priceCurrency explicitly. Include GTIN/UPC — these are essential infrastructure for AI agents, not optional SEO.
• Add MerchantReturnPolicy and OfferShippingDetails — AI shopping agents skip stores without return and shipping information.

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Organic Cotton T-Shirt - Navy - M",
  "sku": "OCCT-NB-M-001",
  "gtin13": "5901234123457",
  "brand": { "@type": "Brand", "name": "YourBrand" },
  "image": "https://yourstore.com/images/tshirt.jpg",
  "offers": {
    "@type": "Offer",
    "price": "29.99",
    "priceCurrency": "USD",
    "availability": "https://schema.org/InStock",
    "shippingDetails": {
      "@type": "OfferShippingDetails",
      "shippingRate": {
        "@type": "MonetaryAmount",
        "value": "0", "currency": "USD"
      }
    }
  }
}
</script>

• Allow AI shopping agents to crawl your site. Key bots: Googlebot, Google-Extended (Gemini), OAI-SearchBot (ChatGPT search), ClaudeBot, bingbot (Copilot), PerplexityBot, and Applebot.
• Ensure /.well-known/ucp is not blocked by wildcard Disallow rules. Add an explicit Allow: /.well-known/ucp if needed.
• Distinction: Google-Extended controls AI training usage. Blocking it does NOT prevent Google from indexing your pages for search or AI Mode.

User-agent: Googlebot
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: OAI-SearchBot
Allow: /

User-agent: ClaudeBot
Allow: /

User-agent: bingbot
Allow: /

User-agent: *
Allow: /.well-known/ucp

Sitemap: https://yourstore.com/sitemap.xml

• Implement three REST endpoints for checkout session lifecycle: create, update, and complete. Amounts are in minor currency units (cents).
• Status flow: incomplete → requires_escalation → ready_for_complete → complete_in_progress → completed / canceled.
• Target response times: Discovery API < 200ms, Checkout API < 500ms, Error rate < 1%.

• Configure Google Pay via the Google Pay & Wallet Console. Verify your PSP supports tokenization. Note your Merchant ID for the manifest.
• UCP supports multiple PSPs — Google Pay, Shop Pay, and standard card networks via Stripe, Adyen, or Braintree.
• Implement webhook-signed order lifecycle notifications (shipped, delivered, returned, refunded). Sign webhooks with HMAC-SHA256 and reject events older than 5 minutes.