Autonomous Checkout for Shopify (UCP, Cart MCP, Checkout Kit)

Autonomous checkout is the part of agentic commerce that engineers actually wire up. The cart has to materialize. The payment has to clear. The order has to land in your store with the right discounts, taxes, and shipping rules. In 2026 that handshake runs on two competing protocols. Shopify and Google's Universal Commerce Protocol (UCP). OpenAI and Stripe's Agentic Commerce Protocol (ACP). Both are open. This post breaks down the architecture in plain technical English.

The two protocols, side by side

You will read 50 different "agentic commerce" announcements in 2026. Most of them are wrappers around one of two underlying protocols.

Universal Commerce Protocol (UCP): co-built by Shopify and Google, open standard, layered architecture, multi-transport. Backed by Amazon, American Express, Etsy, Mastercard, Meta, Microsoft, Salesforce, Stripe, Target, Walmart, and Visa. Full architectural breakdown is on Shopify Engineering's UCP post.

Agentic Commerce Protocol (ACP): jointly maintained by OpenAI and Stripe as founding maintainers, open-sourced specification on GitHub, focused on connecting buyers, AI agents, and merchants for purchases. Documented at OpenAI Developers commerce page.

UCP is the more comprehensive architecture. ACP is the simpler, narrower spec optimized for ChatGPT-style flows. Most Shopify merchants will end up using UCP through Shopify's defaults and never write a line of code. Developers building custom agentic surfaces need to understand both.

UCP architecture (the three layers)

UCP applies a layered pattern to commerce. Reading the layers in order is the cleanest way to understand it.

Layer 1 - Base shopping service. Defines the core commerce primitives every transaction needs. Checkout session. Line items. Totals. Status messages. The base service lives at the dev.ucp.shopping schema and never changes shape. Everything else builds on it.

Layer 2 - Capabilities. Self-contained functional modules that sit on top of the base. The current capabilities are Checkout, Orders, Catalog (product discovery and cart), and Identity Linking. Each capability is independently versioned. Catalog v2 can ship without forcing Checkout to upgrade. This is the part that maps closest to "what the AI agent is doing right now."

Layer 3 - Extensions. Optional, domain-specific add-ons that extend a capability's schema. Loyalty points. Discounts. Subscriptions. Specialized fulfillment (white-glove delivery, made-to-order, BOPIS). Extensions plug into capabilities via composition without changing the base schema.

The lesson here is versioning. UCP separates the things that change (extensions) from the things that should not (base service), which is what made HTTP and TCP survive 30 years. Whether UCP survives that long depends on adoption, not on architecture.

UCP transport protocols (five options)

UCP supports five transport bindings. The business logic stays the same. The envelope swaps depending on the agent's preference.

• REST is the primary binding. HTTPS plus JSON. Universal compatibility with any HTTP client. This is what most third-party integrations will use.
• GraphQL for clients that want typed queries and selective field fetching. Same business operations, GraphQL envelope.
• JSON-RPC for clients that prefer remote procedure call semantics over REST. Lower overhead in some cases.
• MCP (Model Context Protocol) is the binding that lets an LLM-based agent invoke UCP "tools" directly within a conversational context. This is where Cart MCP lives.
• A2A (Agent-to-Agent) envisions direct agent communication exchanging structured UCP data without traditional HTTP overhead. Less common today, important for multi-agent shopping flows in 2027.

For a Shopify Plus merchant integrating with a single agent surface today, REST or MCP is what you will use. For a marketplace platform aggregating multiple agents, you will likely speak all five.

Cart MCP (how AI agents actually build carts)

Cart MCP is the binding that matters most for LLM-driven shopping. The agent has a conversation with the user, decides what the user wants, and then needs to materialize a cart that the merchant can fulfill. Cart MCP exposes the cart operations (add line item, apply discount, set shipping, calculate totals) as tools the LLM can invoke.

The flow looks like this in practice.

1. User says "find me a moisturizer under $40 that ships to Mumbai."
2. Agent searches via UCP Catalog capability, returns candidates.
3. User picks one and confirms.
4. Agent calls Cart MCP create_cart, then add_line_item.
5. Agent calls Cart MCP set_shipping_address with the user's saved or provided address.
6. Cart MCP returns calculated totals (subtotal, shipping, tax, applicable discounts).
7. Agent calls UCP Checkout capability to hand off to payment.
8. Payment clears via the merchant's existing Shopify payment stack.
9. Order lands in Shopify Admin as a normal order, attributed to the agent surface.

The merchant writes none of this code. Shopify exposes the Cart MCP endpoints on behalf of every store opted into UCP. The merchant's catalog, pricing rules, and shipping rules flow through automatically. Our shopper-facing companion post on how AI agents now shop on behalf of shoppers covers the user side of this flow.

Checkout Kit (embedding Shopify checkout in any agent)

Checkout Kit is Shopify's developer-facing library for embedding the full Shopify checkout experience inside any agent or third-party surface. Microsoft Copilot was the first major implementation in late 2025. The mechanic is straightforward. The agent surface includes the Checkout Kit JavaScript library. When the user is ready to pay, the library renders Shopify's checkout inline. Card data, address, shipping selection, all in the chat. The agent never sees the payment information. Shopify processes it server-side.

For developers, Checkout Kit shipped with React, Vue, and vanilla JavaScript bindings. The agent platform handles the rendering. Shopify handles the payment, fraud, tax calculation, and order creation. ECP (Embedded Commerce Protocol) is the open-protocol form of Checkout Kit's logic, born from Checkout Kit and distilled into a standard so any agent surface can adopt the same UX without depending on Shopify's library specifically.

Universal Cart (multi-merchant carts)

Universal Cart is the most ambitious part of the UCP stack. A traditional cart holds items from one merchant. Universal Cart holds items from any number of merchants and resolves to a single checkout the user can pay through once. The technical work happens at the protocol level. Each line item carries its merchant identity, fulfillment options, and pricing rules. Checkout resolution iterates per-merchant for tax, shipping, and inventory holds, then presents the user with one payment screen.

For Shopify merchants this is invisible. Your items appear in a Universal Cart alongside items from other merchants. The user pays once. You receive your portion as a normal order in your store. The complexity of multi-merchant settlement is handled by the payment processor (typically Stripe or Shop Pay) and the agent platform.

OpenAI ACP (the other protocol)

OpenAI launched the Agentic Commerce Protocol on September 29, 2025 with Etsy as the first integrated merchant. ACP is narrower than UCP. The spec focuses on three things. Product feed ingestion (you push a gzip-compressed file in JSONL, CSV, or XML format to an OpenAI-provided endpoint). Cart and checkout primitives. Embedded checkout rendering inside ChatGPT.

OpenAI's Instant Checkout (built on ACP) struggled in early 2026. Merchant onboarding was harder than expected, multi-item carts had bugs, and loyalty integrations were missing. OpenAI retired Instant Checkout in March 2026 in favor of a lighter "dedicated retailer apps" model (Walmart, Target, and Instacart got dedicated ChatGPT apps). The ACP spec itself remains open and active on the ACP GitHub repository. PayPal is launching an ACP server to bring tens of millions of small businesses into the protocol in late 2026.

The honest take on UCP vs ACP: UCP is the broader architecture with stronger industry backing. ACP is more accessible for solo merchants who want a simple product feed they push to one endpoint. Most Shopify merchants will end up on both, with UCP as the primary integration through Shopify's defaults.

UCP security model

Every UCP request carries four mandatory headers.

• UCP-Agent identifies the agent making the call. Verified against an agent registry maintained at the protocol level. Spoofed agent identities get rejected.
• request-signature carries a cryptographic signature of the request body. The merchant (or Shopify on behalf of the merchant) verifies the signature against the agent's public key.
• idempotency-key protects against duplicate submissions. The same request retried multiple times produces one cart, one checkout, one order.
• request-id provides traceability across the agent, the protocol layer, and the merchant. Essential for debugging multi-system flows.

For Shopify merchants on standard Shopify or Shopify Plus, all four headers are handled automatically. Shopify validates incoming UCP requests and presents the result to your store as a normal order. Developers building agent surfaces themselves need to implement all four. Shopify's checkout optimization guide for 2026 covers the merchant-side checkout architecture that sits underneath.

The four fees that merchants pay across surfaces

Fee structure varies sharply by agent surface. This is the part most merchants miss when picking which agents to support.

• OpenAI ChatGPT (Agentic Storefronts): 4 percent on attributed sales. The highest take rate of any agent surface.
• Microsoft Copilot: variable by enterprise tenant. Typically negotiated as part of broader Microsoft 365 contracts. Most merchants see 0 to 3 percent.
• Google AI Mode and Gemini: no separate fee. Standard Google Shopping rates apply, billed through Google Ads if you use paid placement.
• Perplexity Merchant Program: zero fees and zero commissions. The cheapest agent surface to be on right now.

For a brand selling 1,000 units a month at $50 AOV, the difference between Perplexity's 0 percent and ChatGPT's 4 percent is $2,000 per month. Not enough to skip ChatGPT given its volume, but enough to actively prioritize Perplexity in your catalog optimization work.

What is the Universal Commerce Protocol (UCP)?

UCP is an open protocol co-developed by Shopify and Google that defines how AI agents transact with merchants. It uses a layered architecture (base shopping service plus independently versioned capabilities like Checkout, Orders, Catalog, and Identity Linking, plus optional domain extensions for loyalty, discounts, subscriptions, and fulfillment). It supports five transport bindings (REST, GraphQL, JSON-RPC, MCP, A2A). For Shopify merchants, UCP support is built into the platform so the agent surfaces (ChatGPT, Copilot, Gemini, Perplexity) can transact with your store without you writing any integration code.

What is the difference between UCP and ACP?

UCP is broader and architectural, with five transport bindings and a layered model spanning catalog, cart, checkout, orders, and identity. It is backed by Shopify, Google, Amazon, Walmart, Target, Etsy, Microsoft, Meta, Stripe, Mastercard, Visa, and American Express. ACP is OpenAI and Stripe's narrower spec focused on connecting buyers, agents, and merchants for purchases, primarily through pushed product feeds (gzipped JSONL/CSV/XML) and embedded checkout. UCP is more ambitious. ACP is simpler to implement for a small merchant pushing a single feed. Most Shopify stores end up on both protocols simultaneously.

Do Shopify merchants have to write code to use UCP or ACP?

No, for most cases. Shopify's platform implements UCP on behalf of every merchant who opts into Agentic Storefronts (free, available from Shopify Admin). The catalog feed, cart endpoints, checkout flow, and security headers are all handled by Shopify. You only need to write code if you are building your own AI agent surface that needs to call UCP from the outside (a custom assistant, a vertical-specific shopping interface, a new agent platform). ACP requires a one-time setup to push a gzipped product feed to OpenAI's endpoint, refreshed daily. Most modern Shopify themes can be configured to generate the ACP feed automatically.

What is Cart MCP and how does it work?

Cart MCP is the MCP (Model Context Protocol) binding of UCP. It exposes cart operations (create_cart, add_line_item, set_shipping_address, calculate_totals) as tools that an LLM agent can invoke during a conversation with a shopper. The agent reads the user's intent, decides what to add to the cart, calls Cart MCP tools sequentially, and gets back a fully-formed cart with calculated totals. The actual checkout is then handed off to UCP's Checkout capability. For Shopify merchants, Cart MCP endpoints are exposed automatically by the platform. The merchant's pricing rules, discounts, and shipping zones flow through without any developer work.

Should I add ACP support to my Shopify store?

If you are a Shopify Plus merchant with engineering capacity and want explicit control over your ChatGPT product surface, yes. The implementation is a daily-refreshed gzipped product feed (JSONL, CSV, or XML) pushed to OpenAI's ingest endpoint. The advantage is more granular control over which products appear in ChatGPT shopping results and how they are described. For standard Shopify merchants without engineering capacity, the default Agentic Storefronts opt-in (which uses UCP) covers the ChatGPT integration without needing custom ACP work. Both protocols can coexist. ACP gives you finer control on OpenAI specifically. UCP gives you broader reach.

Where this is going next

The 2026 protocol race will probably consolidate. UCP's architectural ambition makes it the more durable standard, but ACP's simplicity gives it adoption velocity. Expect both to coexist for at least two years, with most large platforms supporting both. The interesting technical work in late 2026 and 2027 will be on the A2A binding (agent-to-agent commerce, where one agent shops at another agent that represents a merchant collective) and on cross-protocol routing (when a merchant's UCP endpoint translates incoming ACP requests).

For Shopify Plus merchants, the practical takeaway: opt into Agentic Storefronts now, monitor your attribution dashboard weekly, and start treating your catalog as the agent's primary input. Our broader context piece on what autonomous commerce is in 2026 covers the strategic layer. The operations-side companion piece on how AI agents now run your store operations covers what is happening on the merchant side of the same shift.

If your team is building custom agent surfaces or considering a deeper integration than the Shopify defaults provide, the ExactWhy team has worked through the UCP and ACP specs for Plus merchants and is happy to take a look at your stack. The protocol decisions you make this quarter will shape what agent traffic looks like for your store through 2028.