UCP, ACP and AP2: the three protocols of agentic commerce
An AI agent can buy from your business only if both sides speak the same language. Today three protocols do most of that work: UCP from Google, ACP from OpenAI and Stripe, and AP2 for proof of what the buyer authorised. Here is what each one does, how they fit together and how we run all three.
Until recently an online shop had one kind of visitor: a person who opened the page, compared offers and pressed the button. Now the comparison often happens in a conversation with an AI assistant, and in the United States ChatGPT users can already pay certain sellers without leaving the chat. For the agent and the shop to understand each other, they need a common language. Today there are three such languages worth knowing: UCP, ACP and AP2.
Why agentic commerce needs protocols
Without a common standard, every AI platform would have to build a separate integration with every shop, and every shop would have to describe its offer, prices and payment in a different way for every platform. A protocol replaces that with one agreed description: what the business sells, how a checkout is opened, how the buyer pays and how the order is confirmed. The business publishes it once, and any compatible agent can read it.
UCP: Google’s common language for the whole purchase
Google announced the Universal Commerce Protocol on 11 January 2026 and developed it together with Shopify, Etsy, Wayfair, Target and Walmart. Visa, Mastercard, Stripe and Adyen are among the companies that support it. UCP covers the whole journey, from finding the offer and buying it to the support after it, and it is built to work with A2A, AP2 and MCP.
In practice the business publishes a machine-readable profile at /.well-known/ucp on its own domain. The agent reads it, opens a checkout with the chosen items and receives the total and the terms. The payment goes through a token, so the agent never sees the card.
How UCP works, with our live profile
ACP: the protocol behind checkout in ChatGPT
OpenAI and Stripe developed the Agentic Commerce Protocol, and since 29 September 2025 it has powered Instant Checkout in ChatGPT. ACP is open source under the Apache 2.0 licence. The business stays the merchant of record: it decides what is sold and how orders are fulfilled, and it can accept or decline each agent and each transaction. Stripe was the first payment provider, with its shared payment token, which lets the buyer pay without the card details reaching the agent or the business.
One point is often misunderstood. Supporting ACP does not put a business in ChatGPT. It makes the checkout ready for agents; to sell in ChatGPT a business also has to apply to OpenAI.
How ACP works, with our live profile
AP2: proof of what the buyer authorised
Google Cloud announced the Agent Payments Protocol on 16 September 2025. AP2 answers a question card payments were not built for: did the buyer really authorise this agent to buy this? It works through mandates, signed digital records of what the buyer allowed. A checkout mandate fixes the items and the amount. A payment mandate travels with the payment, so the payment side also knows that an agent took part. AP2 is available as an extension of A2A and UCP, and Google has donated version 0.2 to the FIDO Alliance.
How AP2 works and what we verify
How the three fit together
UCP and ACP do a similar job in two different ecosystems: both describe how an agent buys from a business, one comes from Google and the other from OpenAI and Stripe. AP2 is not a third checkout. It adds proof of consent and can sit on top of UCP. MCP, which often appears next to them, is the protocol through which an agent uses tools, for example to read a catalogue.
So a business does not have to choose. The sensible approach is one catalogue, one set of prices and terms and one order record, with several doors in front of them: one for each protocol the buyers’ agents use.
How we did it at Brand Design Ltd.
Brand Design Ltd. in Varna sells its services through all of these doors at once. Our UCP profile is published on branddesign.ltd in two versions, 2026-08-25 and 2026-04-08. Since 9 October 2026 the UCP checkout verifies AP2 checkout mandates before any charge. The ACP profile and our MCP server, which is listed in the official MCP Registry, use the same catalogue and the same order records. An agent pays only for an offer that has been accepted with a concrete amount.
On 21 September 2026 an outside AI agent found one of our offers on its own in a public test, ordered it and paid, and the public verifier returned PASS. Every item, with the address where you can check it, is listed in our implementation record.
Everything that runs, with addresses to check
What to check in your own business
Before any protocol, the basics have to be in place. Are your prices and terms public and written so that a machine can read them without guessing? Is there one catalogue that every channel reads, or several copies that disagree? Does your payment provider accept tokens from agents? Is every offer tied to the terms the buyer saw? Only then does it make sense to open the doors for agents.
One limit is worth stating plainly. Supporting UCP or ACP does not by itself admit a business to Google’s AI shopping or to ChatGPT; both platforms decide who takes part. Our own Google Pay connection is still in test mode until Google approves the integration.
Related topics
