What is UCP? The Universal Commerce Protocol, explained

What is UCP?

UCP (Universal Commerce Protocol) is an open-source standard co-developed by Google and Shopify. It defines a universal way for AI agents to browse, search, and buy from any merchant, without needing custom integrations for each store.

The simplest way to think about it: HTML is how merchants talk to humans through browsers. UCP is how merchants talk to AI agents. Same idea, new era.

Today, if you want to buy shoes online, you open a browser, see a visual page with images and buttons, click "Size 11," click "Add to Cart," scroll down, click "Checkout." Every step depends on you having eyes and a mouse. An AI agent can't do that reliably. Without a standard, every agent would need to either scrape each merchant's website (fragile, breaks constantly, merchants actively block it) or build a custom integration with every single store (doesn't scale at all).

UCP solves this by giving agents a structured, standardized language to do what humans do visually: discover products, build carts, initiate checkouts, and track orders.

What UCP actually covers

UCP defines the schema and interaction patterns for four core commerce operations:

• Catalog discovery: the agent searches a merchant's products with structured filters (category, size, price range, availability) and gets back clean, machine-readable data. No HTML parsing, no scraping.
• Cart management: the agent adds items, modifies quantities, and applies coupons, all through a standard API contract that works the same across every UCP-compatible merchant.
• Checkout initiation: the agent kicks off the purchase flow, collects shipping and payment preferences, and hands off to AP2 for the cryptographic authorization.
• Order tracking: post-purchase, the agent can check fulfillment status, shipping updates, and delivery confirmations through the same standard.

Why it isn't "just an API doc"

Because it sure looks like one. The difference is that it's the same for everyone.

At its core, UCP is closer to a standardized API specification than to a "protocol" in the way AP2 is a protocol. There's no cryptography, no mandate signing, no trust chain. It's fundamentally about structure and interoperability.

But the reason it matters beyond a single API doc is scope. Shopify has an API. Amazon has an API. Foot Locker has an API. They all work differently: different schemas, different authentication, different ways to search products, different cart structures, different checkout flows. If you're an agent trying to shop across 10,000 merchants, you'd need 10,000 custom integrations.

UCP says: here's one universal schema that every merchant implements the same way. So any agent can talk to any merchant without custom glue code.

Think of it like REST. Knowing an API is RESTful doesn't tell you what endpoints exist, what the data model looks like, or how a checkout flow works. UCP fills that gap specifically for commerce. It defines multi-step interaction patterns (search, cart, checkout, fulfillment) so that agents and merchants share a common contract.

How a merchant adopts UCP

For most merchants, the answer is: your platform adopts it and you get it for free.

If you're on Shopify, the expectation is that Shopify builds UCP support natively into the platform. Shopify sits on the UCP Tech Council alongside Google, Amazon, Meta, Microsoft, Salesforce, and Stripe. At some point, a Shopify merchant would toggle a setting and their catalog, cart, and checkout become agent-browsable through UCP. No code required, the same way a Shopify merchant today doesn't build their own payment gateway.

If you're running a custom stack (commercetools, a homegrown backend), you'd need to implement the UCP spec against your existing catalog and checkout systems. It takes real engineering work, but the spec spells out exactly what to build.

Where Beltic fits in

UCP solves the language problem. Any agent can now walk into any store and ask for what it wants in a way the store understands. What UCP doesn't do, and was never designed to do, is tell the store who it's talking to.

Think of it like a restaurant that suddenly accepts orders from anyone, in any language, through one universal order form. Great for business. But the form only says "two steaks, table four." It doesn't say who placed the order, whether they can pay, or whether it's the same person who ran off without paying last week. When an agent shows up through UCP, the merchant gets a perfectly formatted request and very little else. A shopping assistant acting for a real customer and a bot trying to drain gift cards look exactly the same.

That's the gap Beltic fills. Beltic sits alongside UCP and answers the questions the protocol leaves open: who is behind this agent, did that person actually authorize this purchase, and does what the agent is doing match what it was asked to do.

Here's how it works in practice. An agent arrives at a merchant through UCP and starts building a cart. Before the order goes through, Beltic looks at the full picture: the agent, the person it claims to represent, what it's trying to buy, and whether anything about the request looks off. It turns all of that into a clear risk read. Then the merchant's own rules decide what happens next: accept the order, decline it, or ask for an extra confirmation from the customer before moving forward.

For the merchant, the payoff is simple. Fewer orders that turn into chargebacks and disputes, without slowing down the good agents that are bringing real customers.

And because Beltic doesn't depend on any single protocol, the same checks apply whether the agent comes in through UCP, AP2, ACP, or whatever standard comes next. UCP gives agents a common way to shop. Beltic makes sure the merchant knows who's doing the shopping.

This post is part of our series on agentic protocols. For how they all fit together, read What are agentic protocols? A plain-English guide.