UCP/ACP Agent for WooCommerce

Description

UCP/ACP Agent for WooCommerce turns your store into a spec-compliant merchant for the two agentic-commerce standards:

• UCP (Universal Commerce Protocol) — the open standard by Google and Shopify used by Gemini and Google AI Mode. This plugin passes the official UCP conformance suite (75/75 tests, protocol version 2026-04-08).
• ACP (Agentic Commerce Protocol) — the OpenAI/Stripe standard used by ChatGPT (checkout currently limited to OpenAI-approved merchants; protocol version 2026-04-17).

What it implements:

• Discovery profiles at /.well-known/ucp and /.well-known/acp.json with published ES256 signing keys (JWK)
• Full checkout-session lifecycle mapped onto your real WooCommerce products, stock, coupons, and shipping zones — completed agent checkouts become normal WooCommerce orders
• RFC 9421 HTTP Message Signatures: signed webhooks, optional strict verification of inbound requests, key rotation with a grace period
• Idempotency, capability/version negotiation, and structured protocol errors on both rails
• Payments: Google Pay via Stripe (UCP) and Stripe Shared Payment Token (ACP), with declines surfaced to the agent; plus a mock handler for testing
• Signed order webhooks (RFC 9421 for UCP platforms, HMAC-SHA256 for ACP)
• Admin screen under WooCommerce → UCP: keys, rotation, strict mode, ACP provisioning, Stripe configuration

Security model: agent-facing checkout endpoints are public by design — that is how the UCP open standard works (any agent may discover and transact; authenticity is provided by HTTP Message Signatures, which you can enforce with strict mode). Orders are only created after payment succeeds, prices and stock are always server-authoritative, the ACP API requires a Bearer key, payment credentials are never stored or echoed, and the shipping-simulation test endpoint is disabled unless you configure a secret.

External services

This plugin communicates with external services only in the following cases:

1. Stripe (api.stripe.com) — only when you configure a Stripe key (directly or via the WooCommerce Stripe gateway). When an AI agent completes a checkout with a Google Pay or Shared Payment Token instrument, the plugin sends the payment token, amount, and currency to Stripe to process the charge, and fetches your Stripe account id once for handler configuration. Subject to the Stripe Services Agreement and Privacy Policy.
2. Google Pay — only when Stripe is configured. The plugin publishes your Google Pay merchant configuration (store name, site host, Stripe merchant id, accepted card networks) in the UCP discovery document and checkout responses so that AI agents can obtain a Google Pay card token for the shopper. The plugin itself never contacts Google; the resulting token is charged through Stripe as described above. Subject to the Google Pay API Terms of Service and Google Privacy Policy.
3. The AI platform contacting your store — when an agent request carries a UCP-Agent header, the plugin fetches that platform’s public profile URL to discover its webhook endpoint and signature keys, and sends order status webhooks (order contents, totals, shipping address) to the webhook URL the platform published or that you configured for ACP. This only happens for platforms that initiate contact with your store or that you configure explicitly. Terms and privacy policy are those of the platform in question.
4. ACP Feed API push — only when you enter a Feed API base URL, feed id, and API token on the settings screen. The plugin then sends your published product catalog (product id or SKU, title, description, URL, image URL, price, availability, GTIN, variant options, categories, and store name) to that URL, once when you click “Push now” and thereafter once a day via WP-Cron. No customer data is included. Terms and privacy policy are those of the platform whose Feed API you configure.

URLs under ucp.dev, acp.dev, pay.google.com, and developers.google.com appear in the plugin’s discovery documents and payment handler declarations as protocol version identifiers, specification links, and JSON Schema references. They are never requested by the plugin.

No data is sent to the plugin author. No analytics or tracking of any kind.