UCP\/ACP Agent for WooCommerce turns your store into a spec-compliant merchant for the two agentic-commerce standards:<\/p>\n\n
What it implements:<\/p>\n\n
\/.well-known\/ucp<\/code> and \/.well-known\/acp.json<\/code> with published ES256 signing keys (JWK)<\/li>\n- Full checkout-session lifecycle mapped onto your real WooCommerce products, stock, coupons, and shipping zones \u2014 completed agent checkouts become normal WooCommerce orders<\/li>\n
- RFC 9421 HTTP Message Signatures: signed webhooks, optional strict verification of inbound requests, key rotation with a grace period<\/li>\n
- Idempotency, capability\/version negotiation, and structured protocol errors on both rails<\/li>\n
- Payments: Google Pay via Stripe (UCP) and Stripe Shared Payment Token (ACP), with declines surfaced to the agent; plus a mock handler for testing<\/li>\n
- Signed order webhooks (RFC 9421 for UCP platforms, HMAC-SHA256 for ACP)<\/li>\n
- Admin screen under WooCommerce \u2192 UCP: keys, rotation, strict mode, ACP provisioning, Stripe configuration<\/li>\n<\/ul>\n\n
Security model:<\/strong> agent-facing checkout endpoints are public by design \u2014 that is how the UCP open standard works (any agent may discover and transact; authenticity is provided by HTTP Message Signatures, which you can enforce with strict mode). Orders are only created after payment succeeds, prices and stock are always server-authoritative, the ACP API requires a Bearer key, payment credentials are never stored or echoed, and the shipping-simulation test endpoint is disabled unless you configure a secret.<\/p>\n\nExternal services<\/h3>\n\n
This plugin communicates with external services only in the following cases:<\/p>\n\n
\n- Stripe (api.stripe.com)<\/strong> \u2014 only when you configure a Stripe key (directly or via the WooCommerce Stripe gateway). When an AI agent completes a checkout with a Google Pay or Shared Payment Token instrument, the plugin sends the payment token, amount, and currency to Stripe to process the charge, and fetches your Stripe account id once for handler configuration. Subject to the Stripe Services Agreement<\/a> and Privacy Policy<\/a>.<\/li>\n
- Google Pay<\/strong> \u2014 only when Stripe is configured. The plugin publishes your Google Pay merchant configuration (store name, site host, Stripe merchant id, accepted card networks) in the UCP discovery document and checkout responses so that AI agents can obtain a Google Pay card token for the shopper. The plugin itself never contacts Google; the resulting token is charged through Stripe as described above. Subject to the Google Pay API Terms of Service<\/a> and Google Privacy Policy<\/a>.<\/li>\n
- The AI platform contacting your store<\/strong> \u2014 when an agent request carries a
UCP-Agent<\/code> header, the plugin fetches that platform's public profile URL to discover its webhook endpoint and signature keys, and sends order status webhooks (order contents, totals, shipping address) to the webhook URL the platform published or that you configured for ACP. This only happens for platforms that initiate contact with your store or that you configure explicitly. Terms and privacy policy are those of the platform in question.<\/li>\n- ACP Feed API push<\/strong> \u2014 only when you enter a Feed API base URL, feed id, and API token on the settings screen. The plugin then sends your published product catalog (product id or SKU, title, description, URL, image URL, price, availability, GTIN, variant options, categories, and store name) to that URL, once when you click \"Push now\" and thereafter once a day via WP-Cron. No customer data is included. Terms and privacy policy are those of the platform whose Feed API you configure.<\/li>\n<\/ol>\n\n
URLs under ucp.dev, acp.dev, pay.google.com, and developers.google.com appear in the plugin's discovery documents and payment handler declarations as protocol version identifiers, specification links, and JSON Schema references. They are never requested by the plugin.<\/p>\n\n
No data is sent to the plugin author. No analytics or tracking of any kind.<\/p>\n\n\n
\nDoes this make my products appear in Gemini or ChatGPT?<\/h3><\/dt>\nIt makes your store protocol-ready. Receiving Google surface traffic additionally requires a Google Merchant Center account; ChatGPT checkout additionally requires OpenAI merchant approval. Any UCP-speaking agent can transact with your store immediately.<\/p><\/dd>\n
Do agents pay real money?<\/h3><\/dt>\nYes, when Stripe is configured: tokens supplied by the platform are charged through your Stripe account. Without Stripe, only the mock test handler is available, and only while a simulation secret is set.<\/p><\/dd>\n
Does it work with HPOS (High-Performance Order Storage)?<\/h3><\/dt>\nYes, compatibility is declared and order access uses HPOS-safe APIs.<\/p><\/dd>\n\n<\/dl>\n\n\n
0.1.0<\/h4>\n\n\n- Initial release: UCP 2026-04-08 (official conformance suite: 75 passed), ACP 2026-04-17, RFC 9421 signatures, Stripe payment handlers, admin screen.<\/li>\n<\/ul>","raw_excerpt":"Make your store buyable by AI agents: Universal Commerce Protocol (UCP) and OpenAI's Agentic Commerce Protocol (ACP) in one plugin.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/362417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=362417"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sunh11373"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=362417"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=362417"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=362417"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=362417"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=362417"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=362417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}