AgentGrade

ACP · UCP · AP2 — the agent-commerce protocols

Payments · ACP: OpenAI/Stripe · UCP: UCP Tech Council · AP2: FIDO Alliance (donation announced April 2026) · Updated 2026-07-31

Status: ACP: OpenAI + Stripe, Sept 2025 · UCP: Google + Shopify, Jan 2026 · AP2: Google, Sept 2025 (FIDO donation announced Apr 2026) — none an IETF standard · Authoritative source

Three overlapping answers to “how does an AI agent buy something?” — a checkout API called by ChatGPT, a self-published merchant profile read by Google-side surfaces, and a mandate format for proving the human said yes. They are not one standard, and none has won.

The three cover different layers. ACP (Agentic Commerce Protocol, OpenAI + Stripe, September 2025) is a checkout-session API the platform calls on the merchant — POST /checkout_sessions, complete, cancel — plus a product feed the merchant pushes privately to OpenAI, with payment handled by delegated tokens on the payment processor’s side. UCP (Universal Commerce Protocol, Google + Shopify, January 2026) inverts the direction: the merchant self-publishes a signed profile at /.well-known/ucp — capabilities in reverse-domain form, JWK signing keys, payment-handler declarations — that platforms discover and call. AP2 (Agent Payments Protocol, Google, September 2025) sits below both: cryptographically signed Checkout and Payment Mandates that make “the human authorized this purchase” verifiable and auditable, payment-method-agnostic, riding on A2A — and since v0.2, covering human-not-present autonomous payments.

2026 sorted the momentum. OpenAI scaled back in-chat Instant Checkout in March (stale merchant data and thin usage were the cited reasons; roughly 30 Shopify merchants had gone live on checkout per Forrester) and pivoted to discover-in-chat, buy-on-merchant — ACP’s live role today is the feed, not the purchase. UCP picked up the broadest coalition: its Tech Council added Amazon, Meta, Microsoft, Salesforce, and Stripe in April 2026 — Stripe co-maintains ACP, so its council seat is the ecosystem’s most-quoted hedge. The same month Google announced AP2’s donation to the FIDO Alliance, moving the authorization layer to neutral ground. UCP composes with AP2 (its payments layer references AP2 mandates) rather than competing; ACP and UCP genuinely compete at the checkout layer, and no official bridge exists.

For a site owner the practical asymmetry is discoverability. UCP is the only one of the three with a public merchant-origin artifact — /.well-known/ucp — so it is the only one an outside scanner (or an unknown agent platform) can detect and verify. ACP’s surfaces are authenticated endpoints and privately pushed feeds; its own FAQ says discovery mechanisms are still being worked on. AP2 lives inside agent-to-agent payment flows and leaves nothing on the origin at all. The takeaway for a merchant: publishing /.well-known/ucp is the only self-serve way to be discoverable to outside platforms today — ACP and AP2 require a direct integration. Protocol churn — three camps, one retreat, one donation, in ten months — is why integrators now sell multi-protocol interoperability: nobody can safely bet on one.

The one probeable artifact: a UCP merchant profile

GET /.well-known/ucp
{ "ucp": { "version": "2026-01-11",
    "capabilities": [ { "name": "dev.ucp.shopping.checkout", ... } ],
    "signing_keys": [ { "kty": "EC", "crv": "P-256", ... } ] },
  "payment": { "handlers": [ ... ] } }

How AgentGrade checks it

The Machine Payments group today verifies the payment rail that already leaves public traces — live x402/402 handshakes, decoded and validated field by field. UCP-profile detection (/.well-known/ucp presence and shape) is on the discovery-sweep roadmap and would start at weight zero per the scanner’s emerging-standard rule; ACP and AP2 leave nothing on a merchant origin to probe yet. Scan your site to see where you stand.

Related

All standards

RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · RFC 9116 · OAuth Discovery · RFC 7591 · RFC 9727 · ACP / UCP / AP2 · Index