AI commerce implementation checklist

Goal

Agents start every UCP interaction by fetching this profile. Without it, no UCP platform can find or negotiate with you.

Note

UCP versions are dated (latest release 2026-08-25). The profile is public and cacheable by design.

How to implement

1. Create a JSON document with a top-level ucp object: version, services, capabilities and payment_handlers.
2. Serve it at https://yourdomain/.well-known/ucp over HTTPS.
3. List only capabilities you actually implement.

{
  "ucp": {
    "version": "2026-08-25",
    "services": { ... },
    "capabilities": { ... },
    "payment_handlers": { ... }
  }
}

Snippet from UCP spec overview, Versioned Profiles example (opens in new tab)

Artifacts /.well-known/ucp

Resources

• UCP spec overview (latest): versioning and hosting (opens in new tab) UCP spec
• UCP spec overview (2026-08-25) (opens in new tab) UCP spec
• UCP getting started (opens in new tab) UCP docs

Audit

Method http_get machine-checkable /.well-known/ucp

GET /.well-known/ucp returns 200 JSON with ucp.version, ucp.services and ucp.capabilities.

{
  "status": 200,
  "content_type": "application/json",
  "json_keys": [
    "ucp.version",
    "ucp.services",
    "ucp.capabilities"
  ]
}

ucp.discovery.well-known JSON

Goal

Platforms cache profiles and treat them as your stable identity. A redirect or a no-store header can stop a platform from processing your requests.

Note

These are MUST rules in the UCP overview, section Profile Requirements, Hosting. ETag or Last-Modified is a SHOULD.

How to implement

1. Serve the profile and referenced schemas over HTTPS.
2. Return the profile directly with 200; no 3xx redirects.
3. Send Cache-Control: public, max-age=60 or higher; never private, no-store or no-cache.
4. Add an ETag or Last-Modified validator.

Artifacts Cache-Control ETag

Depends on ucp.discovery.well-known

Resources

• UCP spec overview (latest): versioning and hosting (opens in new tab) UCP spec

Audit

Method http_get machine-checkable /.well-known/ucp

GET without following redirects returns 200 (not 3xx); Cache-Control contains public and max-age >= 60 and no private/no-store/no-cache; ETag or Last-Modified present.

{
  "status": 200,
  "no_redirect": true,
  "headers": {
    "cache-control": "public; max-age>=60; not private|no-store|no-cache"
  },
  "headers_any": [
    "etag",
    "last-modified"
  ]
}

ucp.profile.hosting JSON

Goal

Checkout is the core UCP transaction. It is what turns agent discovery into an order.

Note

Bindings exist for REST, MCP, A2A and embedded checkout. Pick the transports your platforms use.

How to implement

1. Declare the checkout capability with its version in /.well-known/ucp.
2. Implement the REST or MCP binding from the spec.
3. Return continue_url where the buyer must finish on your site.

Artifacts checkout capability

Depends on ucp.discovery.well-known

Resources

• UCP spec overview (latest): versioning and hosting (opens in new tab) UCP spec
• UCP on GitHub (opens in new tab) UCP spec

Audit

Method code_review human check

Run the official samples or conformance tooling from the UCP repo against your endpoint.

ucp.capabilities.checkout JSON

Goal

Catalog lets agents search and look up products, cart supports multi-item baskets, order lets agents track status after purchase.

Note

Capability compatibility is by exact version equality, not by date order.

How to implement

1. Add each implemented capability with its version to the profile.
2. Implement the matching REST or MCP binding.

Artifacts catalog cart order

Depends on ucp.discovery.well-known

Resources

• UCP spec overview (latest): versioning and hosting (opens in new tab) UCP spec

Audit

Method http_get machine-checkable /.well-known/ucp

Each capability listed in the profile carries a version; endpoints respond per the spec.

{
  "status": 200,
  "json_keys": [
    "ucp.capabilities"
  ]
}

ucp.capabilities.catalog-cart-order JSON

Goal

Lets an agent link to the buyer's existing account so loyalty, addresses and order history carry over.

Note

Only needed if you support identity linking.

How to implement

1. Expose an OAuth 2.0 authorization server.
2. Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.

Artifacts /.well-known/oauth-authorization-server

Resources

• UCP spec overview (2026-08-25) (opens in new tab) UCP spec
• UCP getting started (opens in new tab) UCP docs

Audit

Method http_get machine-checkable /.well-known/oauth-authorization-server

GET returns 200 JSON with issuer, authorization_endpoint and token_endpoint (RFC 8414).

{
  "status": 200,
  "content_type": "application/json",
  "json_keys": [
    "issuer",
    "authorization_endpoint",
    "token_endpoint"
  ]
}

ucp.identity.oauth-metadata JSON

Goal

Keeps raw card data out of the agent and the merchant, and lets your PSP plug into UCP.

Note

Payment handlers are declared in the profile under payment_handlers.

How to implement

1. Ask your PSP for its UCP payment handler.
2. Declare it under payment_handlers in /.well-known/ucp.

Artifacts payment handler

Depends on ucp.discovery.well-known

Resources

• UCP spec overview (latest): versioning and hosting (opens in new tab) UCP spec

Audit

Method http_get machine-checkable /.well-known/ucp

Profile JSON contains a non-empty ucp.payment_handlers object.

{
  "status": 200,
  "json_keys": [
    "ucp.payment_handlers"
  ]
}

ucp.payment.handler JSON

Goal

Gives you cryptographic proof of what the user authorized, which helps with disputes.

Note

Optional in UCP. AP2 itself is at v0.2 and moving to FIDO Alliance working groups.

How to implement

1. Advertise the AP2 mandates extension in your profile.
2. Verify mandates per the extension spec.

Artifacts AP2 mandates extension

Depends on ap2.mandates.verify

Resources

• UCP AP2 mandates extension (opens in new tab) UCP spec

Audit

Method code_review human check

Profile advertises the AP2 extension and sample mandates verify.

ucp.payment.ap2-extension JSON

Goal

Google's agentic checkout reads your Merchant Center data; without it you are not eligible.

Note

Updated 2026-10-15: Google says UCP checkout is live in the US via Universal Cart in AI Mode in Search and the Gemini app since 15 Oct 2026, with Google Pay checkout or handoff to the merchant cart; the merchant stays seller of record. US only per Google's blog. Merchants join a waitlist (Google Merchant UCP docs, 2026-10-12). ucp.dev: Lodging draft specification available (not yet in a release; latest release v2026-08-25); Food coming soon.

How to implement

1. Keep an active Merchant Center feed.
2. Follow Google's UCP onboarding in the Merchant docs.

Artifacts Merchant Center account product feed

Depends on gmc.feed.active

Resources

• Google Merchant: UCP (opens in new tab) Google docs
• Google blog: Universal Cart launch (15 Oct 2026) (opens in new tab) Google announcement
• UCP on GitHub (opens in new tab) UCP spec
• UCP releases on GitHub (opens in new tab) UCP spec

Audit

Method platform_console human check

Products appear eligible in Merchant Center for the UCP program.

ucp.google.merchant-center JSON

Goal

Version selection and capability matching depend on it. A wrong value breaks negotiation.

Note

Resolved: the spec says the version MUST be a dated release and MUST NOT be a non-date string such as draft. Releases on GitHub: 2026-01-11, 2026-01-23, 2026-04-08, 2026-08-25.

How to implement

1. Set ucp.version to the dated release you implement.
2. Optionally map older releases to full profiles in supported_versions.
3. Never publish pre-release implementations through public discovery.

Artifacts ucp.version supported_versions

Depends on ucp.discovery.well-known

Resources

• UCP spec overview (latest): versioning and hosting (opens in new tab) UCP spec
• UCP releases on GitHub (opens in new tab) UCP spec

Audit

Method http_get machine-checkable /.well-known/ucp

ucp.version matches ^\d{4}-\d{2}-\d{2}$ and equals a published release.

{
  "status": 200,
  "json_keys": [
    "ucp.version"
  ],
  "json_pattern": {
    "ucp.version": "^\\d{4}-\\d{2}-\\d{2}$"
  }
}

ucp.version.pin JSON

Goal

These endpoints let an agent create, update and complete a checkout on your backend.

Note

ACP spec versions are dated folders in the repo (latest seen 2026-04-17).

How to implement

1. Implement the checkout session endpoints from the agentic checkout RFC (POST /checkout_sessions and follow-ups).
2. Version your API per the dated spec folder.

Artifacts checkout endpoints (REST or MCP)

Resources

• ACP RFC: agentic checkout (opens in new tab) ACP spec
• ACP on GitHub (opens in new tab) ACP spec
• Agentic Commerce Protocol (opens in new tab) ACP spec

Audit

Method code_review human check

Run the ACP spec test flow from the repo against your endpoints.

acp.checkout.endpoints JSON

Goal

The agent never holds raw card data; the PSP issues a scoped token you can charge.

How to implement

1. Pick a PSP that supports ACP delegated payment.
2. Charge the token you receive on checkout completion.

Artifacts Shared Payment Token

Depends on acp.checkout.endpoints

Resources

• ACP RFC: delegate payment (opens in new tab) ACP spec
• Stripe agentic commerce docs (opens in new tab) Stripe docs

Audit

Method code_review human check

Complete a test payment with a Shared Payment Token in Stripe test mode.

acp.payment.delegated-token JSON

Goal

OpenAI says feeds give greater control over how products appear and keep pricing and availability current.

Why this status Not a protocol MUST; OpenAI says feeds give more control than crawling.

Note

Re-verified 2026-10-12. A feed is not strictly needed (ChatGPT also crawls sites), per OpenAI. Shopify and Etsy catalogs are already integrated, no setup needed. Feeds can also arrive via providers such as Salesforce and Stripe. Shopping is live in the US only; new applicants join a waitlist.

How to implement

1. If you sell on Shopify or Etsy, check that your catalog is synced; no application is needed.
2. Otherwise apply via chatgpt.com/merchants.
3. Build the feed to the OpenAI product feed spec.

Artifacts product feed

Depends on openai.feed.required-fields

Resources

• OpenAI: powering product discovery in ChatGPT (opens in new tab) OpenAI announcement
• OpenAI product feed spec (opens in new tab) OpenAI spec
• ChatGPT merchants (opens in new tab) OpenAI docs

Audit

Method platform_console human check

Feed accepted in OpenAI merchant onboarding; Upload History shows no rejected rows.

acp.feed.openai JSON

Goal

Agents can check ACP support and the API base URL from just your domain, without opening a checkout session.

Note

Resolved: the mechanism is specified in rfc.discovery.md, but its status is Proposal and version unreleased. Treat as optional until it lands in a dated spec.

How to implement

1. Serve /.well-known/acp.json at the origin root, publicly, without auth.
2. Include protocol name and version, api_base_url, transports and capabilities.
3. Send Cache-Control: public, max-age=3600 (SHOULD).

Artifacts /.well-known/acp.json

Depends on acp.checkout.endpoints

Resources

• ACP RFC: discovery (/.well-known/acp.json) (opens in new tab) ACP spec
• ACP on GitHub (opens in new tab) ACP spec

Audit

Method http_get machine-checkable /.well-known/acp.json

GET returns 200 JSON with api_base_url and transports; Cache-Control public with max-age >= 3600.

{
  "status": 200,
  "content_type": "application/json",
  "json_keys": [
    "api_base_url",
    "transports"
  ],
  "headers": {
    "cache-control": "public; max-age>=3600"
  }
}

acp.discovery.mechanism JSON

Goal

Attribute ChatGPT visits and revenue per product with tags you control.

Note

The products spec neither allows nor forbids extra query parameters in url. Using chatgpt.com as utm_source keeps it aligned with the referrer hostname. Templates follow Simon Vreeman's convention (vreeman.com/utm): required utm_source and utm_medium; optional utm_campaign, utm_content, utm_term, utm_source_platform, utm_creative_format and utm_marketing_tactic. For AI assistants choose the medium yourself (not referral). Templates use {ai_medium}. Option A: utm_medium=ai-assistant lands in GA4's built-in AI Assistant default channel with no setup (support.google.com/analytics/answer/9756891). Option B: your own medium (for example ai) plus a GA4 custom channel group placed above Referral; without that group the traffic lands in Unassigned. Recommendation, not an OpenAI rule. The audit only checks that source and medium are present and lowercase; it does not enforce a specific medium value.

How to implement

1. Required: append ?utm_source=chatgpt.com&utm_medium={ai_medium} to every url (use & if a query string exists), all lowercase. Replace {ai_medium} with your choice (Option A or B).
2. Optional: also add utm_campaign=chatgpt-shopping, utm_content={item_id}, utm_source_platform=openai (and other optional UTMs when useful).
3. Keep values static per item so url stays stable.
4. Do not strip UTM parameters in redirects.
5. Also segment on referrer chatgpt.com; if you pick Option B, create a GA4 custom channel group (see measurement.referrer-segments).

Artifacts utm_source=chatgpt.com utm_medium {ai_medium}

Depends on measurement.utm.feed-links

Resources

• OpenAI file upload: products spec (opens in new tab) OpenAI spec
• Simon Vreeman: GA4 UTM convention and builder (opens in new tab) Simon Vreeman (convention) docs
• GA4 default channel group (opens in new tab) Google docs

Audit

Method feed_check machine-checkable

Every OpenAI feed row's url carries utm_source=chatgpt.com and a utm_medium value (any lowercase value; the audit does not enforce a specific medium), no duplicates, and returns 200. Optional UTMs (campaign, content, term, source_platform, creative_format, marketing_tactic) are reported as info only.

{
  "url_fields": [
    "url"
  ],
  "query_params": {
    "utm_source": "chatgpt.com"
  },
  "required_params": [
    "utm_source",
    "utm_medium"
  ],
  "optional_params": [
    "utm_campaign",
    "utm_content",
    "utm_term",
    "utm_source_platform",
    "utm_creative_format",
    "utm_marketing_tactic"
  ],
  "lowercase": true,
  "no_duplicate_params": true,
  "http_status": 200
}

acp.analytics.utm JSON

Goal

Avoids spending engineering time on a checkout path ChatGPT does not use for most merchants.

Why this status Superseded per OpenAI's own announcement; ACP itself remains a spec.

Note

Re-verified 2026-10-12 against the OpenAI post and chatgpt.com/merchants. Shopping in ChatGPT is live in the US only. Merchants wanting deeper integration can build a ChatGPT app (Walmart's app supports account linking, loyalty and Walmart payments). The feed spec still lists is_eligible_checkout, but says checkout requires a separately enabled integration.

How to implement

1. Focus on the product feed and your own site checkout.
2. For a deeper in-ChatGPT experience, consider a ChatGPT app instead of ACP checkout endpoints.
3. Ask OpenAI during onboarding before building ACP checkout for ChatGPT.

Resources

• OpenAI: powering product discovery in ChatGPT (opens in new tab) OpenAI announcement
• OpenAI product feed spec (opens in new tab) OpenAI spec
• ChatGPT merchants (opens in new tab) OpenAI docs

Audit

Method manual human check

Confirm with current OpenAI merchant docs before any checkout build for ChatGPT.

acp.checkout.instant-checkout-discovery-only JSON

Goal

Personal agents find your sign-in server and APIs or company agent from this file.

Note

Draft 0.1 published 9 Oct 2026 (frozen at /docs/0.1/spec); draft 0.2 in progress with breaking changes.

How to implement

1. Serve /.well-known/poppy.json over HTTPS.
2. Include protocol_version 0.1, organization, auth issuer and the surfaces you offer.

Artifacts /.well-known/poppy.json

Resources

• Personal Agent Protocol spec (version 0.1) (opens in new tab) Personal Agent Protocol spec
• Personal Agent Protocol changelog (opens in new tab) Personal Agent Protocol spec
• Sierra: introducing Personal Agent Protocol (opens in new tab) Sierra announcement

Audit

Method http_get machine-checkable /.well-known/poppy.json

GET returns 200 JSON with protocol_version, organization and auth.

{
  "status": 200,
  "content_type": "application/json",
  "json_keys": [
    "protocol_version",
    "organization",
    "auth"
  ]
}

poppy.discovery.poppy-json JSON

Goal

Lets a user's own agent act in their account with scoped, revocable access.

Note

Draft 0.1 published 9 Oct 2026; draft 0.2 in progress with breaking changes. Sign-in variants in 0.1: direct, device and mediated.

How to implement

1. Run an OAuth server listed under auth.issuer in poppy.json.
2. Accept JWT-bearer assertions from agents whose client_id is a metadata URL.
3. Validate DPoP proofs on each request.

Artifacts client metadata document DPoP

Depends on poppy.discovery.poppy-json

Resources

• Personal Agent Protocol spec (version 0.1) (opens in new tab) Personal Agent Protocol spec

Audit

Method code_review human check

A test agent obtains a scoped token and calls an API with a DPoP proof.

poppy.identity.oauth JSON

Goal

Gives personal agents something to do once signed in.

Note

Draft 0.1 published 9 Oct 2026; draft 0.2 in progress with breaking changes.

How to implement

1. List your MCP or HTTP APIs, or a company agent, in poppy.json.

Artifacts APIs company agent

Depends on poppy.discovery.poppy-json

Resources

• Personal Agent Protocol spec (version 0.1) (opens in new tab) Personal Agent Protocol spec

Audit

Method code_review human check

Endpoints listed in poppy.json respond.

poppy.surface.api-or-agent JSON

Goal

Prevents building on a part of the protocol that does not exist yet.

Note

Resolved: personalagentprotocol.org/docs/open-topics lists Payments as not covered yet. Use a payment protocol (for example AP2, MPP or your PSP) alongside. Draft 0.1 published 9 Oct 2026; draft 0.2 in progress with breaking changes.

How to implement

1. Keep payments in your existing checkout or a separate payment protocol.
2. Re-check Open topics on each draft update.

Resources

• Personal Agent Protocol: open topics (opens in new tab) Personal Agent Protocol spec
• Personal Agent Protocol spec (version 0.1) (opens in new tab) Personal Agent Protocol spec

Audit

Method manual human check

Re-check the Open topics page for a payments section.

poppy.payment.none JSON

Goal

Gives proof that the user approved the exact cart and payment, which helps dispute resolution.

Note

Verifiers always receive closed checkout and payment mandates; autonomous flows add open mandates signed by the user.

How to implement

1. Verify the closed checkout mandate against the checkout you issued.
2. Verify the closed payment mandate and any open mandates per the spec.

Artifacts checkout mandate payment mandate

Resources

• AP2 specification (opens in new tab) AP2 (Google) spec
• AP2 on GitHub (opens in new tab) AP2 (Google) spec
• AP2 site (opens in new tab) AP2 spec

Audit

Method code_review human check

Verify sample mandates from the AP2 repo.

ap2.mandates.verify JSON

Goal

Merchants and networks can only trust agent purchases they can verify.

How to implement

1. Use the AP2 SDK and samples to create and sign mandates.

Artifacts mandate signing

Resources

• AP2 specification (opens in new tab) AP2 (Google) spec
• AP2 on GitHub (opens in new tab) AP2 (Google) spec

Audit

Method code_review human check

Generate mandates with the AP2 samples and verify them.

ap2.mandates.issue JSON

Goal

Plan for spec changes before building production dependencies on AP2.

Why this status Pre-release; not a live network.

Note

Resolved: ap2-protocol.org states standardization continues within the FIDO Agentic Authentication and Payments Technical Working Groups, and links the FIDO and Google announcements.

How to implement

1. Pin to v0.2.0 and track the GitHub releases.
2. Follow FIDO Alliance working group output.

Resources

• AP2 site (opens in new tab) AP2 spec
• AP2 releases on GitHub (v0.2.0) (opens in new tab) AP2 (Google) spec
• FIDO Alliance to develop standards for trusted AI agent interactions (opens in new tab) FIDO Alliance announcement
• Google: AP2 and the FIDO Alliance (opens in new tab) Google announcement

Audit

Method manual human check

Check ap2-protocol.org and GitHub releases for a stable version.

ap2.status.pre-release JSON

Goal

Separates trusted, credentialed agents from anonymous bots, without relying on IP addresses.

Note

Tag agent-browser-auth marks browsing, agent-payer-auth marks checkout. Ed25519 in the examples. Usually verified at your CDN (Visa names Cloudflare and Akamai).

How to implement

1. Read Signature-Input and Signature headers.
2. Fetch the key by keyid and verify the signature.
3. Reject expired signatures and reused nonces.

Artifacts Signature-Input Signature

Depends on visa-tap.keys.retrieve

Resources

• Visa TAP specifications (opens in new tab) Visa spec
• Visa TAP on GitHub (opens in new tab) Visa spec
• Visa: live agentic commerce transactions across Europe (2 July 2026) (opens in new tab) Visa announcement

Audit

Method code_review human check

Verify a sample signed request from the Visa TAP repo.

visa-tap.signatures.verify JSON

Goal

You need the key to verify a signature.

Note

Cache keys and refresh when an unknown keyid appears.

How to implement

1. Fetch https://mcp.visa.com/.well-known/jwks.
2. Select the key by keyid from Signature-Input.

Artifacts JWKS

Resources

• Visa TAP specifications (opens in new tab) Visa spec

Audit

Method http_get machine-checkable https://mcp.visa.com/.well-known/jwks

GET https://mcp.visa.com/.well-known/jwks returns a JWKS; your verifier uses it.

{
  "status": 200,
  "json_keys": [
    "keys"
  ]
}

visa-tap.keys.retrieve JSON

Goal

Without onboarding, merchants cannot treat your agent as trusted.

Note

Resolved in part: agents onboard through Visa Intelligent Commerce per the Visa spec, but Visa publishes no public step-by-step onboarding guide. Contact Visa.

How to implement

1. Apply to Visa as an agent provider.
2. Sign with RFC 9421 and the TAP tags once onboarded.

Resources

• Visa TAP specifications (opens in new tab) Visa spec
• Visa TAP on GitHub (opens in new tab) Visa spec

Audit

Method manual human check

Visa onboarding confirmation.

visa-tap.agent.sign JSON

Goal

Registration lets the network recognise agentic transactions and apply the right risk controls.

Note

Resolved: Mastercard Developers merchant guide. Mastercard reports live agentic transactions in several markets.

How to implement

1. Ask your PSP about readiness for Agent Pay and Visa Intelligent Commerce.
2. Request registration for your business through them.
3. Recognize registered agents via Web Bot Auth at your CDN.
4. Accept agentic tokens in your existing card fields.

Artifacts agentic tokens

Resources

• Mastercard Developers: the rails for agentic commerce (opens in new tab) Mastercard docs
• Mastercard Developers: getting started with agentic commerce (opens in new tab) Mastercard docs
• Mastercard Agent Pay docs (opens in new tab) Mastercard docs
• Mastercard unveils Agent Pay (opens in new tab) Mastercard announcement
• Mastercard Agent Pay Acceptance Framework (opens in new tab) Mastercard announcement

Audit

Method vendor_confirmation human check

Your PSP confirms registration for Agent Pay.

mastercard.agent-pay.tokens JSON

Goal

Network recognition and liability rules depend on certification and agentic tokens.

Note

Resolved: Mastercard Developers Level 1 guide and the Agent Pay Acceptance Framework (Web Bot Auth, built on RFC 9421, verified at the CDN). No public self-service agent registration.

How to implement

1. Apply for agent certification with the network.
2. Sign requests with Web Bot Auth.
3. Use agentic tokens, never stored cards on file.

Depends on web-bot-auth.verify

Resources

• Mastercard Developers: Level 1 agentic commerce (opens in new tab) Mastercard docs
• Mastercard Developers: the rails for agentic commerce (opens in new tab) Mastercard docs
• Mastercard Agent Pay docs (opens in new tab) Mastercard docs
• Mastercard Agent Pay Acceptance Framework (opens in new tab) Mastercard announcement

Audit

Method vendor_confirmation human check

Agent appears in the network's trusted agent registry.

mastercard.agent-pay.platform JSON

Goal

Blocking them loses real customers; normal card-not-present controls still apply.

Note

Mastercard's guidance, not a protocol rule.

How to implement

1. Apply tiered trust: verified agents, then unverified traffic with 3-D Secure, AVS and CVV.
2. Do not reject purely on missing Agent Pay, TAP or ACE headers.

Resources

• Mastercard Developers: Level 1 agentic commerce (opens in new tab) Mastercard docs

Audit

Method config_review human check

Review bot rules and WAF policies for blanket blocks on unsigned agents.

mastercard.consumer-agents.no-block JSON

Goal

Signals where agent onboarding across networks is heading.

Note

Resolved: announcement only. It names Visa TAP, Mastercard Verifiable Intent and Ant's Agentic Mobile Protocol as inputs. No KYA spec is linked from the official announcement as of 2026-10-19.

How to implement

1. Implement the network protocols that exist today (Visa TAP, Web Bot Auth).
2. Re-check the backers' newsrooms for a spec.

Resources

• Ant International, Mastercard and Visa on Know-Your-Agent (opens in new tab) Ant International announcement

Audit

Method manual human check

Check for a published spec on the backers' official sites.

kya.watch JSON

Goal

Charge agents per request without accounts or API keys.

Note

Stablecoin settlement (for example USDC on Base). A facilitator can verify and settle so you need no chain connectivity.

How to implement

1. Install the x402 middleware for your framework (Express, Hono, Next).
2. Configure price, network, pay-to address and facilitator per route.
3. Test on base-sepolia before base.

Artifacts HTTP 402 response PAYMENT-REQUIRED PAYMENT-SIGNATURE PAYMENT-RESPONSE

Resources

• x402 quickstart for sellers (opens in new tab) x402 docs
• x402 on GitHub (opens in new tab) x402 Foundation spec
• Cloudflare Agents: x402 (opens in new tab) Cloudflare docs

Audit

Method http_get machine-checkable {paid_route}

Request a paid route without payment: 402 with a PAYMENT-REQUIRED header.

{
  "status": 402,
  "headers_present": [
    "payment-required"
  ]
}

x402.middleware JSON

Goal

Monetise APIs or content for agents without changing origin code.

Note

With Bot Management you can charge only low bot scores and allowlist crawlers by detection ID.

How to implement

1. Deploy the x402-proxy template.
2. Set PAY_TO, NETWORK and PROTECTED_PATTERNS in wrangler.jsonc.
3. Optionally add bot_score_threshold and except_detection_ids.

{
  "vars": {
    "PAY_TO": "0xYourWalletAddress",
    "NETWORK": "base-sepolia",
    "PROTECTED_PATTERNS": [
      { "pattern": "/api/premium/*", "price": "$0.10", "description": "Premium API access" }
    ]
  }
}

Snippet from Cloudflare: charge for HTTP content with x402 (opens in new tab)

Artifacts x402-proxy Worker wrangler.jsonc

Depends on x402.middleware

Resources

• Cloudflare: charge for HTTP content with x402 (opens in new tab) Cloudflare docs
• Cloudflare Agents: agentic payments (opens in new tab) Cloudflare docs

Audit

Method http_get machine-checkable {paid_route}

Protected pattern returns 402 with PAYMENT-REQUIRED; unprotected routes pass through.

{
  "status": 402,
  "headers_present": [
    "payment-required"
  ]
}

x402.cloudflare.proxy JSON

Goal

Sell individual agent actions (for example a price check) next to free tools.

Note

Price is in USD; network base or base-sepolia.

How to implement

1. Wrap McpServer with withX402(config).
2. Register priced tools with paidTool(name, description, price, schema, annotations, handler).

server = withX402(new McpServer({ name: "PaidMCP", version: "1.0.0" }), {
  network: "base",
  recipient: "0xYourWalletAddress",
  facilitator: { url: "https://x402.org/facilitator" },
});
this.server.paidTool("square", "Squares a number", 0.01, { number: z.number() }, {},
  async ({ number }) => ({ content: [{ type: "text", text: String(number ** 2) }] }));

Snippet from Cloudflare: charge for MCP tools with x402 (opens in new tab)

Artifacts withX402 paidTool

Depends on mcp.server

Resources

• Cloudflare: charge for MCP tools with x402 (opens in new tab) Cloudflare docs

Audit

Method code_review human check

Call the paid tool from an x402 client; it requires payment, the free tool does not.

x402.mcp.paid-tool JSON

Goal

Agents can find your paid endpoints without a pre-built integration.

Note

The x402 docs call the Bazaar early development; APIs may change.

How to implement

1. Add the bazaar extension to your route configuration.
2. Use a facilitator that supports discovery.

Artifacts bazaar extension

Depends on x402.middleware

Resources

• x402 Bazaar discovery layer (opens in new tab) x402 docs

Audit

Method registry_lookup human check

Your endpoint appears in the facilitator's /discovery/resources listing.

x402.bazaar JSON

Goal

Your agent can buy access to paid APIs and tools.

How to implement

1. Use an x402 client SDK or withX402Client from the Agents SDK.
2. Add a spending confirmation step for users.

Artifacts x402 client

Depends on x402.middleware

Resources

• x402 on GitHub (opens in new tab) x402 Foundation spec
• Cloudflare: pay from the Agents SDK with x402 (opens in new tab) Cloudflare docs

Audit

Method code_review human check

Client completes a paid request on testnet.

x402.client JSON

Goal

Accept agent payments by card (via Stripe), stablecoins or custom methods on one interface.

Note

Intents: charge, session and subscription. MPP is backwards compatible with x402 clients per Cloudflare.

How to implement

1. npm i hono mppx
2. Store the signing key: npx wrangler secret put MPP_SECRET_KEY
3. Add mppx.charge(...) before the paid handler.

const mppx = Mppx.create({
  methods: [tempo.charge({ testnet: true })],
  secretKey: workerEnv.MPP_SECRET_KEY,
});
app.get("/premium", mppx.charge({
  amount: "0.01",
  currency: "0x20c0000000000000000000000000000000000000",
  description: "Premium API access",
  recipient: "<YOUR_WALLET_ADDRESS>",
}), (c) => c.json({ access: "paid" }));

Snippet from Cloudflare: accept payments with MPP (opens in new tab)

Artifacts mppx WWW-Authenticate: Payment Payment-Receipt

Resources

• MPP server quickstart (opens in new tab) MPP docs
• MPP specs on GitHub (opens in new tab) Tempo (MPP) spec
• Cloudflare: accept payments with MPP (opens in new tab) Cloudflare docs

Audit

Method http_get machine-checkable {paid_route}

Unpaid request returns 402 with WWW-Authenticate: Payment; a paid retry returns a Payment-Receipt header.

{
  "status": 402,
  "headers_present": [
    "www-authenticate"
  ],
  "header_contains": {
    "www-authenticate": "Payment"
  }
}

mpp.middleware JSON

Goal

Paywall content or APIs for agents without touching your origin.

Note

Bot Management can limit the paywall to low bot scores, keeping the site free for humans.

How to implement

1. Deploy cloudflare/mpp-proxy.
2. Set PAY_TO, PAYMENT_CURRENCY and PROTECTED_PATTERNS in wrangler.jsonc.
3. Use TEMPO_TESTNET true while testing.

Artifacts mpp-proxy Worker

Depends on mpp.middleware

Resources

• Cloudflare: charge for HTTP content with MPP (opens in new tab) Cloudflare docs
• Cloudflare Agents: agentic payments (opens in new tab) Cloudflare docs

Audit

Method http_get machine-checkable {paid_route}

Protected pattern returns 402 with WWW-Authenticate: Payment.

{
  "status": 402,
  "headers_present": [
    "www-authenticate"
  ]
}

mpp.cloudflare.proxy JSON

Goal

Charge per agent action over MCP.

Note

MCP tools use the same Challenge, Credential, Receipt flow over JSON-RPC.

How to implement

1. npm i agents mppx @modelcontextprotocol/sdk zod
2. Bind the McpAgent Durable Object in wrangler.jsonc.
3. Wrap paid tools with the MPP transport per the guide.

Artifacts McpAgent mppx

Depends on mcp.server

Resources

• Cloudflare: accept payments with MPP (opens in new tab) Cloudflare docs

Audit

Method code_review human check

An MPP client is challenged on the paid tool and receives a receipt after paying.

mpp.mcp.charge JSON

Goal

Agents and registries (MPPScan, mpp.dev services) learn prices before calling.

Note

Discovery is advisory; the runtime 402 challenge stays authoritative.

How to implement

1. Serve OpenAPI 3.1 at /openapi.json.
2. Add x-payment-info per paid operation: intent, method, amount, currency.
3. Optionally register with MPPScan or the mpp.dev services directory.

Artifacts /openapi.json x-payment-info

Depends on mpp.middleware

Resources

• MPP discovery (opens in new tab) MPP docs
• MPP specs on GitHub (opens in new tab) Tempo (MPP) spec

Audit

Method http_get machine-checkable /openapi.json

GET returns 200 JSON, openapi 3.1.x, and at least one operation with x-payment-info.

{
  "status": 200,
  "content_type": "application/json",
  "json_keys": [
    "openapi",
    "paths"
  ],
  "body_contains": [
    "x-payment-info"
  ]
}

mpp.discovery.openapi JSON

Goal

Lets you take agent payments into your existing Stripe balance.

How to implement

1. Follow the Stripe MPP docs to enable machine payments.

Resources

• Stripe MPP docs (opens in new tab) Stripe docs

Audit

Method code_review human check

Test payment succeeds in the Stripe docs flow.

mpp.psp.stripe JSON

Goal

Your agent can buy from MPP and, per Cloudflare, existing x402 services.

How to implement

1. Configure the agent wallet and payment method per the Cloudflare guide.
2. Add user approval for spend.

Artifacts mppx client

Depends on mpp.middleware

Resources

• Cloudflare: pay from the Agents SDK with MPP (opens in new tab) Cloudflare docs
• MPP server quickstart (opens in new tab) MPP docs

Audit

Method code_review human check

Agent completes a paid call on testnet.

mpp.client JSON

Goal

One PSP integration covers several agent surfaces.

How to implement

1. Braintree: confirm Agent Ready eligibility in the Braintree control panel.
2. PayPal (UCP only): integrate the Google Pay payment handler through PayPal Orders v2.

Artifacts Braintree

Resources

• PayPal Agent Ready overview (opens in new tab) PayPal docs
• PayPal agentic commerce services (opens in new tab) PayPal announcement

Audit

Method platform_console human check

Agent Ready shows enabled in the Braintree control panel.

paypal.braintree JSON

Goal

Agents can query catalog, stock or orders directly instead of scraping.

How to implement

1. Build a server with an official MCP SDK.
2. Expose read tools first; add write tools with auth.

Artifacts MCP server

Resources

• MCP: build a server (opens in new tab) MCP docs
• MCP specification repo (opens in new tab) MCP spec

Audit

Method code_review human check

Connect with the MCP Inspector and list tools.

mcp.server JSON

Goal

Other agents can discover and call your agent.

How to implement

1. Write the Agent Card JSON per the A2A spec.
2. Serve it at /.well-known/agent-card.json.

Artifacts /.well-known/agent-card.json

Resources

• A2A specification (opens in new tab) A2A spec
• A2A tutorials (opens in new tab) A2A docs
• A2A on GitHub (opens in new tab) A2A spec

Audit

Method http_get machine-checkable /.well-known/agent-card.json

GET returns 200 JSON with name, url and skills.

{
  "status": 200,
  "content_type": "application/json",
  "json_keys": [
    "name",
    "skills"
  ]
}

a2a.agent-card JSON

Goal

Needed if you run a merchant agent that other agents should talk to.

How to implement

1. Follow the A2A tutorials to implement the server.

Artifacts A2A server

Depends on a2a.agent-card

Resources

• A2A tutorials (opens in new tab) A2A docs

Audit

Method code_review human check

Run the tutorial client against your server.

a2a.server JSON

Goal

Signals how sites may ask agents for proof of identity, age or membership before granting access.

Note

Draft spec v0.2.0 from Proof, open under Apache-2.0; Circle co-endorses it. Launched 25 Jun 2026. Proof says it plans to submit x401 to the FIDO Alliance (stated plan only): "Proof will submit x401 to the FIDO Alliance's agentic authentication standards workgroup." Not needed for retail checkout today.

How to implement

1. Read the draft spec if you gate routes by identity, age or membership.
2. Re-check the spec version before building.

Resources

• x401 spec (draft 0.2.0) (opens in new tab) Proof spec
• x401 on GitHub (opens in new tab) Proof (x401) spec
• Proof launches x401 (PRWeb release by Proof, 25 Jun 2026) (opens in new tab) Proof (via PRWeb) announcement

Audit

Method manual human check

Check the spec version on x401.proof.com/spec/latest/.

x401.watch JSON

Goal

Lets browser agents complete actions on your site through defined tools instead of guessing at the UI.

Note

Chrome origin trial from Chrome 149; under active discussion and subject to change. Chrome says it is primarily designed for local browser workflows with a human in the loop. Shopify checkout supports WebMCP tools since 28 Sep 2026 with no merchant configuration.

How to implement

1. On Shopify: nothing to configure for checkout tools.
2. Elsewhere: read the Chrome docs and consider the origin trial before building.

Resources

• Chrome for Developers: WebMCP (opens in new tab) Google Chrome docs
• Shopify changelog: WebMCP support for checkout (28 Sep 2026) (opens in new tab) Shopify announcement

Audit

Method manual human check

Check the Chrome WebMCP docs for the current origin trial status.

webmcp.watch JSON

Goal

Google's AI Mode and UCP checkout draw on Merchant Center data.

Why this status UCP on Google uses Merchant Center data; no feed means no eligibility.

Note

Re-verified 2026-10-12 against the product data specification. Google: if you leave out a Required attribute, the product can't serve in ads and free listings. The field lists are in gmc.feed.required-fields and gmc.feed.conditional-fields.

How to implement

1. Submit a feed per the Google product data specification.
2. Also meet Google's other requirements: Shopping ads policies, landing page, shipping rate, checkout, and currency and language requirements.
3. Fix disapprovals in Diagnostics.

Artifacts Merchant Center feed

Resources

• Google product data specification (opens in new tab) Google spec
• Google Merchant: UCP (opens in new tab) Google docs

Audit

Method platform_console human check

Merchant Center diagnostics show no disapprovals for key products.

gmc.feed.active JSON

Goal

Google: if you don't submit a Required attribute, your product won't be able to serve in ads and free listings.

Note

Re-verified 2026-10-12. Use structured_title and structured_description for text created with generative AI. Availability and price must match the landing page, checkout and Schema.org markup.

How to implement

1. Map your catalog to the seven attributes.
2. Keep availability and price identical across feed, landing page, checkout and structured data.
3. Use availability values in_stock, out_of_stock, preorder or backorder; add availability_date for preorder and backorder.

Artifacts id title description link image_link availability price

Depends on gmc.feed.active

Resources

• Google product data specification (opens in new tab) Google spec

Audit

Method feed_check machine-checkable

Every feed row has id, title or structured_title, description or structured_description, link, image_link, availability and price.

{
  "required_fields": [
    "id",
    "title",
    "description",
    "link",
    "image_link",
    "availability",
    "price"
  ]
}

gmc.feed.required-fields JSON

Goal

Missing a conditional attribute that applies to you has the same effect as missing a Required one.

Why this status Required by Google when the stated condition applies.

Note

Re-verified 2026-10-12. Apparel and variants: age_group, gender, color and size are required for apparel targeting Brazil, France, Germany, Japan, the UK and the US, and item_group_id for variants in those countries; free listings require them for Apparel and Accessories in all countries. Also conditional: adult (adult content), is_bundle and multipack (merchant-made bundles or multipacks in 12 countries including the Netherlands), certification (for example EU energy labels), material and pattern (when they distinguish variants), unit pricing and energy efficiency class (when local law requires), external_seller_id (multi-seller accounts), promotion_id (promotions in Australia, France, Germany, India, the UK and the US), shipping_weight and dimensions (carrier-calculated rates).

How to implement

1. List which conditions apply to your catalog and target countries.
2. Add those attributes to your primary or supplemental data source.
3. For Dutch shops: shipping cost is required (via the shipping attribute or account settings).

Artifacts brand mpn gtin condition availability_date shipping age_group gender color size item_group_id is_bundle multipack

Depends on gmc.feed.required-fields

Resources

• Google product data specification (opens in new tab) Google spec
• Google Merchant Center: GTIN (opens in new tab) Google docs

Audit

Method platform_console human check

Merchant Center Diagnostics shows no missing-attribute issues for your target countries.

gmc.feed.conditional-fields JSON

Goal

Google: they help AI systems and conversational agents understand product nuances and help customers discover your products on AI-driven surfaces like AI Mode in Search.

Note

Re-verified 2026-10-12. Google calls them completely optional; including them won't affect approval status. Don't duplicate what you already submit in description, product_highlight or product_detail.

How to implement

1. Add them via a supplemental data source (Google's recommendation), your primary data source or the Merchant API.
2. related_product takes relationship_type:identifier_type:identifier, for example accessory:gtin:811571013579.
3. variant_option takes name:value pairs and works with item_group_id and item_group_title.
4. popularity_rank is a percentage of your total inventory; higher means more popular.

Artifacts question_and_answer document_link related_product item_group_title variant_option popularity_rank

Depends on gmc.feed.active

Resources

• Google Merchant Center: conversational attributes (opens in new tab) Google docs

Audit

Method platform_console human check

Attributes visible in Merchant Center product details.

gmc.conversational-attributes JSON

Goal

Rows missing these are not useful for discovery; invalid availability rejects the row.

Note

Re-verified 2026-10-12 against the file upload products spec. Omitted, empty or unrecognized availability rejects the row; use unknown explicitly when stock status is unknown. item_id must be stable and never reused for a different item. Price is the regular price in major currency units plus currency code, for example 79.99 USD.

How to implement

1. Map your catalog to the nine fields.
2. Use explicit availability values (in_stock, out_of_stock, pre_order, backorder, unknown).

{"item_id":"MUG-350-BLUE","title":"Blue ceramic mug, 350 mL","description":"Dishwasher-safe glazed ceramic mug with a handle.","url":"https://example.com/products/mug-blue","brand":"Northline","seller_name":"Northline Home","image_url":"https://example.com/images/mug-blue.jpg","price":"18.00 USD","availability":"in_stock"}

Snippet from OpenAI feed spec, minimal example (opens in new tab)

Artifacts item_id title description url brand seller_name image_url availability price

Resources

• OpenAI file upload: products spec (opens in new tab) OpenAI spec
• OpenAI product feed spec (opens in new tab) OpenAI spec

Audit

Method feed_check machine-checkable

Every feed row has all nine required fields with valid values.

{
  "required_fields": [
    "item_id",
    "title",
    "description",
    "url",
    "brand",
    "seller_name",
    "image_url",
    "availability",
    "price"
  ]
}

openai.feed.required-fields JSON

Goal

Without approval OpenAI does not ingest your feed.

Note

Re-verified 2026-10-12. Shopify and Etsy catalogs are already integrated and need no application. Shopping is live in the US. OpenAI's prohibited products policy excludes, among others, adult content, alcohol, nicotine, gambling, weapons and prescription-only medication.

How to implement

1. Check your catalog against OpenAI's prohibited products policy.
2. Apply at chatgpt.com/merchants.
3. Then follow OpenAI's integration path: decide file upload or API, review the spec, validate required fields, upload, keep current.

Artifacts merchant application

Resources

• OpenAI commerce: get started (opens in new tab) OpenAI docs
• ChatGPT merchants (opens in new tab) OpenAI docs

Audit

Method vendor_confirmation human check

OpenAI has confirmed your feed registration.

openai.onboarding.apply JSON

Goal

Keeps price and availability in ChatGPT current; stale data hurts how products appear.

Why this status OpenAI's recommended cadence, not a hard requirement.

Note

Re-verified 2026-10-12. Products missing from a snapshot are retained up to 14 days; set is_eligible_search=false to remove search eligibility at the next processing. OpenAI matches products by item_id, not filename. No completion marker is needed; processing starts once uploads stop changing.

How to implement

1. Push a full snapshot via SFTP at least daily, overwriting a stable file name.
2. Shard at up to 500k items or about 500 MB per file; keep the shard set stable and upload all shards without long pauses.
3. Start with about 100 sample items, QA the first full snapshot, then automate.
4. For small feeds or intraday changes, upsert via the API.

Artifacts SFTP parquet jsonl.gz

Depends on openai.feed.format, openai.onboarding.apply

Resources

• OpenAI file upload overview (opens in new tab) OpenAI spec
• OpenAI commerce: get started (opens in new tab) OpenAI docs

Audit

Method platform_console human check

SFTP upload timestamps show at least one full snapshot per day; no ingestion failures reported.

openai.feed.delivery JSON

Goal

Files in a non-supported format or with non-spec field names fail ingestion.

Note

Re-verified 2026-10-12. The Google-compatible path requires id, title, description, link, image_link, availability, price and brand on every row; uses preorder (not pre_order); does not accept unknown; ignores is_eligible_search=false; and keeps checkout disabled.

How to implement

1. Pick the OpenAI format unless OpenAI confirmed the Google-compatible path for your feed.
2. Use lowercase, underscore-separated column names; no g: prefixes.
3. Encode as UTF-8.

Artifacts JSONL CSV TSV

Resources

• OpenAI file upload overview (opens in new tab) OpenAI spec
• OpenAI file upload: products spec (opens in new tab) OpenAI spec

Audit

Method platform_console human check

Upload succeeds and Upload History shows the expected format.

openai.feed.format JSON

Goal

Feeds Copilot shopping and Copilot Checkout.

How to implement

1. Create a store in Microsoft Merchant Center.
2. Import your Google feed or upload a catalog file.

Artifacts id title description link image_link price

Resources

• Microsoft Merchant Center catalog file (opens in new tab) Microsoft docs
• Microsoft: Google attributes import (opens in new tab) Microsoft docs

Audit

Method platform_console human check

Catalog shows approved offers.

msmc.feed JSON

Goal

Copilot Checkout eligibility.

Note

Re-verified 2026-10-12: the current Microsoft agentic commerce page supersedes the January 2026 blog post, which said MMC was not required. UCP-ready feed attributes include native checkout eligibility, product warnings and Merchant Item ID.

How to implement

1. Add Merchant Item ID to your feed.
2. Follow the Microsoft agentic commerce onboarding.

Artifacts Merchant Item ID

Depends on msmc.feed

Resources

• Microsoft Advertising: agentic commerce (opens in new tab) Microsoft announcement

Audit

Method feed_check human check

Merchant Item ID present in the feed.

msmc.copilot-checkout JSON

Goal

Keeps on-page data machine readable and consistent with your feeds.

Note

No AI surface states it uses on-page markup as a checkout source.

How to implement

1. Add JSON-LD Product with offers to each product page.
2. Make values match the feed.

Artifacts Product Offer gtin sku mpn

Depends on gtin.feeds

Resources

• schema.org/Product (opens in new tab) Schema.org spec
• schema.org/gtin (opens in new tab) Schema.org spec

Audit

Method html_parse machine-checkable {product_url}

Validate with the Schema Markup Validator; values match the feed.

{
  "jsonld_types": [
    "Product",
    "Offer"
  ]
}

schema.product-markup JSON

Goal

Early alignment with retail feed vocabulary.

Note

No consumer has confirmed using these yet.

How to implement

1. Add only properties you can keep accurate.

Artifacts consumerNotice isOftenBoughtWith itemPopularity minimumOrderValue hasDigitalProductPassport

Depends on schema.product-markup

Resources

• Schema.org releases (opens in new tab) Schema.org spec

Audit

Method code_review human check

Properties validate against schema.org v30.1.

schema.v30-1-retail JSON

Goal

GTIN is how agents match the same product across merchants, feeds and markup.

Why this status Microsoft requires GTIN when assigned; Google strongly recommends it and may disapprove products missing an assigned GTIN; OpenAI marks it optional.

Note

Re-verified 2026-10-12 against Google's GTIN page. Don't submit a GTIN for products without one (store brands, custom items); use brand and mpn instead. Each variant needs its own GTIN. Ideally provide GTIN together with MPN.

How to implement

1. Store manufacturer GTINs in your PIM.
2. Export them to every feed and to on-page markup.

Artifacts gtin

Resources

• Google Merchant Center: GTIN (opens in new tab) Google docs
• Microsoft Merchant Center catalog file (opens in new tab) Microsoft docs
• OpenAI product feed spec (opens in new tab) OpenAI spec

Audit

Method feed_check machine-checkable

Merchant Center reports no missing or invalid GTIN issues.

{
  "field_present": "gtin",
  "when": "manufacturer assigned"
}

gtin.feeds JSON

Goal

Google may disapprove or limit products with invalid or incorrect GTINs.

Why this status Invalid GTINs are rejected by Google Merchant Center.

Note

Re-verified 2026-10-12. Keep GTINs as strings to preserve leading zeros. Google accepts UPC (GTIN-12; convert UPC-E), EAN (GTIN-13), JAN (8 or 13), ISBN-13 and ITF-14. Don't guess or make up a value.

How to implement

1. Validate check digits in your PIM before export.
2. Convert ISBN-10 to ISBN-13 and UPC-E to 12 digits.
3. Do not reuse one GTIN for several products with the same variant attributes in the same country and language.

Artifacts gtin8 gtin12 gtin13 gtin14

Depends on gtin.feeds

Resources

• Google Merchant Center: GTIN (opens in new tab) Google docs
• OpenAI product feed spec (opens in new tab) OpenAI spec

Audit

Method feed_check machine-checkable

All GTINs pass length and GS1 check digit validation.

{
  "gtin_regex": "^(\\d{8}|\\d{12}|\\d{13}|\\d{14})$",
  "gs1_check_digit": true
}

gtin.valid JSON

Goal

See which surface drove each visit. Organic and cpc media map into GA4 Default Channel Groups. For AI assistants, pick Option A (utm_medium=ai-assistant, GA4 built-in channel) or Option B (own medium plus custom channel group; see measurement.referrer-segments). Optional UTMs add campaign and product detail.

Note

Templates follow Simon Vreeman's convention (vreeman.com/utm): required utm_source and utm_medium (lowercase, no duplicates, URL returns 200); optional utm_campaign, utm_term, utm_content, utm_source_platform, utm_creative_format, utm_marketing_tactic. For AI assistants choose the medium yourself (not referral). Templates use {ai_medium}. Option A: utm_medium=ai-assistant lands in GA4's built-in AI Assistant default channel with no setup (support.google.com/analytics/answer/9756891). Option B: your own medium (for example ai) plus a GA4 custom channel group placed above Referral; without that group the traffic lands in Unassigned. Conflicts: a platform appended utm_source may override or duplicate yours; Google Ads auto-tagging (gclid) usually decides attribution in linked GA4 (assumption). Do not tag a link that both free listings and ads use as organic; use ads_redirect for cpc. No official UCP or ACP guidance on UTMs was found. The audit only checks that source and medium are present and lowercase; it does not enforce a specific medium value.

How to implement

1. Required on every feed URL: utm_source and utm_medium, lowercase, no duplicates; tagged URL returns 200.
2. AI assistants: replace {ai_medium} with your choice (Option A ai-assistant, or Option B e.g. ai); sources stay per assistant (chatgpt.com, gemini, perplexity, copilot, claude).
3. Optional (examples): OpenAI url also ?utm_campaign=chatgpt-shopping&utm_content={item_id}&utm_source_platform=openai
4. Optional: Google free listings also &utm_campaign=shopping-free-listings&utm_content={id}
5. Optional: Google or Microsoft ads_redirect also &utm_campaign={campaign}-shopping&utm_content={id}
6. Optional: UCP or ACP hand off also &utm_campaign=agentic-checkout&utm_content={item_id}
7. Minimal required examples: OpenAI ?utm_source=chatgpt.com&utm_medium={ai_medium}; Google link ?utm_source=google&utm_medium=organic; ads_redirect ?utm_source=google|bing&utm_medium=cpc; hand off ?utm_source={agent host}&utm_medium={ai_medium}.
8. Append with & when a query string exists.
9. If you pick Option B, create a GA4 custom channel group (see measurement.referrer-segments).

Artifacts utm_source utm_medium ads_redirect {ai_medium}

Depends on acp.feed.openai

Resources

• Simon Vreeman: GA4 UTM convention and builder (opens in new tab) Simon Vreeman (convention) docs
• OpenAI file upload: products spec (opens in new tab) OpenAI spec
• Google product data specification (opens in new tab) Google spec
• Microsoft Merchant Center catalog file (opens in new tab) Microsoft docs
• GA4 default channel group (opens in new tab) Google docs

Audit

Method feed_check machine-checkable

Parse every feed URL: utm_source and utm_medium present once (any medium value; the audit does not enforce a specific medium), all lowercase, and the URL returns 200. Optional UTMs (campaign, content, term, source_platform, creative_format, marketing_tactic) are reported as info only.

{
  "url_fields": [
    "url",
    "link",
    "ads_redirect"
  ],
  "required_params": [
    "utm_source",
    "utm_medium"
  ],
  "optional_params": [
    "utm_campaign",
    "utm_content",
    "utm_term",
    "utm_source_platform",
    "utm_creative_format",
    "utm_marketing_tactic"
  ],
  "lowercase": true,
  "no_duplicate_params": true,
  "http_status": 200
}

measurement.utm.feed-links JSON

Goal

See AI assistant traffic as one channel: either GA4's built-in AI Assistant channel (Option A) or your own custom channel group (Option B), with referrer matching as a backup.

Note

Recommendation only. The site does not pick the medium for the shop. Apps and privacy settings often strip referrers, so referrer matching undercounts. Review the host list against your own referral report. GA4 default channel definitions: support.google.com/analytics/answer/9756891.

How to implement

1. Pick Option A (utm_medium=ai-assistant) or Option B (own medium, e.g. ai).
2. Option A: no custom channel group needed; confirm sessions land in GA4's AI Assistant default channel.
3. Option B: in GA4, create a custom channel group with a channel named AI assistants. Rule: Medium exactly matches your chosen value OR Session source matches regex chatgpt\.com|gemini\.google\.com|perplexity\.ai|copilot\.microsoft\.com|claude\.ai. Place AI assistants above Referral.
4. Optionally keep a separate segment on the same source regex for explorations.

Artifacts {ai_medium} ai-assistant referrer custom channel group

Depends on measurement.utm.feed-links

Resources

• GA4 default channel group (opens in new tab) Google docs
• Simon Vreeman: GA4 UTM convention and builder (opens in new tab) Simon Vreeman (convention) docs

Audit

Method analytics human check

If Option A: GA4 default AI Assistant channel shows tagged sessions. If Option B: custom channel group shows AI assistants sessions for your medium and matching referrers. Compare with tagged feed traffic.

measurement.referrer-segments JSON

Goal

Lets you allow or charge verified agents and treat others differently, based on cryptography instead of user agent strings.

Note

Based on IETF drafts (protocol: draft-ietf-webbotauth-httpsig-protocol-00); Cloudflare supports Ed25519. Agents host keys at /.well-known/http-message-signatures-directory.

How to implement

1. Turn on verified bots and agents at your CDN, or verify Signature headers yourself.
2. For your own agent: generate an Ed25519 key, host the JWKS directory, register with Cloudflare.

openssl genpkey -algorithm ed25519 -out private-key.pem
openssl pkey -in private-key.pem -pubout -out public-key.pem

Snippet from Cloudflare: Web Bot Auth (opens in new tab)

Artifacts /.well-known/http-message-signatures-directory

Resources

• Cloudflare: Web Bot Auth (opens in new tab) Cloudflare docs
• Mastercard Developers: Level 1 agentic commerce (opens in new tab) Mastercard docs
• Cloudflare press release: payments companies and Web Bot Auth (14 Oct 2025) (opens in new tab) Cloudflare announcement

Audit

Method config_review human check

Your CDN or verifier logs show signed agent requests as verified.

web-bot-auth.verify JSON

Goal

Make a deliberate choice per kind of bot instead of an accidental one: blocking training crawlers does not have to remove your products from AI answers.

Note

Each vendor states its own tokens and semantics; we only list tokens from official vendor pages. Google-Extended and Applebot-Extended are control tokens that do not crawl. Applebot follows Googlebot rules when it is not named. Bingbot feeds the Bing index, which Microsoft says also feeds Copilot and grounding results; there is no separate Copilot token, and NOARCHIVE or NOCACHE limit Copilot use (Bing Webmaster Guidelines). Full token list with kind and source per vendor: /commerce/api/bots (MCP tool list_ai_bots).

How to implement

1. List every AI token in /commerce/api/bots and decide allow or disallow per kind (training, search, user).
2. Write explicit groups per token in robots.txt; a group for a token replaces the * group for that bot.
3. Remember the most specific (longest) rule wins and allow wins a tie (RFC 9309).
4. Check product and category paths, not only /.
5. Re-check after platform or CDN changes, which can rewrite robots.txt.

Artifacts /robots.txt

Resources

• RFC 9309: Robots Exclusion Protocol (opens in new tab) IETF spec
• OpenAI: overview of OpenAI crawlers (opens in new tab) OpenAI docs
• Anthropic: crawlers and how to block them (opens in new tab) Anthropic docs
• Google: common crawlers (incl. Google-Extended) (opens in new tab) Google docs
• Google: user-triggered fetchers (incl. Google-Agent) (opens in new tab) Google docs
• Apple: About Applebot (opens in new tab) Apple docs
• Perplexity: crawlers (opens in new tab) Perplexity docs
• Meta: web crawlers (opens in new tab) Meta docs
• Common Crawl: CCBot (opens in new tab) Common Crawl docs
• Bing Webmaster: which crawlers does Bing use (opens in new tab) Microsoft docs
• Bing Webmaster Guidelines (opens in new tab) Microsoft docs

Audit

Method robots_txt machine-checkable /robots.txt

Fetch /robots.txt, resolve the group for each token in /commerce/api/bots (RFC 9309 matching), and report whether / and a sample product URL are allowed, grouped by kind. A missing robots.txt (4xx) means all allowed.

{
  "bot_kinds": [
    "training",
    "search",
    "user",
    "classic_search"
  ],
  "allow_paths": [
    "/",
    "{product_url}"
  ]
}

access.robots.ai-crawlers JSON

Goal

Shoppers who ask an assistant about your products can only be sent to pages it was allowed to read.

Why this status Recommended for shops because blocking removes products from AI answers per the vendors' own docs; a business can still decide otherwise.

Note

Recommended for shops, our reading: OpenAI says sites opted out of OAI-SearchBot will not be shown in ChatGPT search answers; Anthropic says blocking Claude-SearchBot or Claude-User may reduce visibility. OpenAI, Perplexity, Google and Meta say their user-triggered fetchers may not follow robots.txt, while Anthropic lets sites control Claude-User through it. Not a vendor requirement.

How to implement

1. Do not disallow search or user tokens on product, category and policy pages.
2. If you block bots at the CDN, make sure search and agent bots still reach those pages (see access.cloudflare.ai-bots).
3. Allow published IP ranges in your WAF where the vendor publishes them.

Artifacts /robots.txt

Depends on access.robots.ai-crawlers

Resources

• OpenAI: overview of OpenAI crawlers (opens in new tab) OpenAI docs
• Anthropic: crawlers and how to block them (opens in new tab) Anthropic docs
• Perplexity: crawlers (opens in new tab) Perplexity docs
• Google: user-triggered fetchers (incl. Google-Agent) (opens in new tab) Google docs
• Meta: web crawlers (opens in new tab) Meta docs
• Apple: About Applebot (opens in new tab) Apple docs
• RFC 9309: Robots Exclusion Protocol (opens in new tab) IETF spec

Audit

Method robots_txt machine-checkable /robots.txt

For every search and user token, / and a sample product URL resolve to allowed under RFC 9309 matching.

{
  "bot_kinds": [
    "search",
    "user"
  ],
  "allow_paths": [
    "/",
    "{product_url}"
  ]
}

access.robots.search-and-user-agents JSON

Goal

Choose deliberately whether your copy and images may train models, without hurting AI search visibility.

Why this status Training is a business choice, so Optional.

Note

Optional: no official source ties training access to shopping visibility. Note that Google-Extended also covers grounding in Gemini Apps and Vertex AI, per Google. CCBot builds an open repository of web crawl data (Common Crawl) that anyone can access and analyze.

How to implement

1. Decide allow or disallow per training token; write explicit groups.
2. Do not use a blanket User-agent: * Disallow to block training, because it also blocks search bots that fall back to *.
3. Document the choice in your robots.txt comments.

Artifacts /robots.txt

Depends on access.robots.ai-crawlers

Resources

• OpenAI: overview of OpenAI crawlers (opens in new tab) OpenAI docs
• Anthropic: crawlers and how to block them (opens in new tab) Anthropic docs
• Google: common crawlers (incl. Google-Extended) (opens in new tab) Google docs
• Apple: About Applebot (opens in new tab) Apple docs
• Meta: web crawlers (opens in new tab) Meta docs
• Common Crawl: CCBot (opens in new tab) Common Crawl docs

Audit

Method robots_txt machine-checkable /robots.txt

Reports per training token whether / is allowed. Informational: both outcomes are valid choices.

{
  "bot_kinds": [
    "training"
  ],
  "allow_paths": [
    "/",
    "{product_url}"
  ]
}

access.robots.training-choice JSON

Goal

Avoid Merchant Center warnings or suspensions and keep Merchant Center data verifiable on Google Shopping surfaces.

Why this status Required: Google issues a warning or suspension when StoreBot cannot access in-store product pages (answer 13484511).

Note

Required for shops using Merchant Center, based on Google's own warning-or-suspension text for in-store pages (answer 13484511). For online-only product pages, Google's StoreBot page (answer 13294660) says highly encouraged and states no penalty. Google advises reverse DNS verification over static IP allowlists, because StoreBot can use different IPs than search crawlers. Product images often sit on a CDN host with its own robots.txt.

How to implement

1. robots.txt: do not disallow Storebot-Google, Googlebot or Googlebot-Image on product, cart, checkout and image paths; Google's example is a group per token with an empty Disallow.
2. Bot detection, WAF or CDN (for example Cloudflare): make sure these crawlers get no 403 or 404; verify Google by reverse DNS rather than static IP lists.
3. Keep landing pages fast, since slow pages can cause crawler timeouts.
4. Add product structured data: it takes precedence over what StoreBot extracts.
5. Then reprocess your feed in Merchant Center.

Artifacts /robots.txt

Depends on access.robots.ai-crawlers

Resources

• Google Merchant Center: fix StoreBot crawler can't access your in-store product page (opens in new tab) Google docs
• Google Merchant Center: About the Google StoreBot crawler (opens in new tab) Google docs
• Google: common crawlers (incl. Google-Extended) (opens in new tab) Google docs
• RFC 9309: Robots Exclusion Protocol (opens in new tab) IETF spec

Audit

Method robots_txt machine-checkable /robots.txt

For Googlebot, Googlebot-Image and Storebot-Google: / , a sample product URL and a sample product image URL resolve to allowed. WAF, bot detection and CDN blocks need a manual check in Merchant Center diagnostics.

{
  "bot_kinds": [
    "merchant_center"
  ],
  "allow_paths": [
    "/",
    "{product_url}",
    "{image_url}"
  ]
}

access.robots.merchant-center JSON

Goal

Avoid an edge rule silently blocking the shopping agents your robots.txt allows.

Note

Cloudflare's Agent preset covers chat fetch bots and browser-use agents, so blocking it can stop user-triggered shopping agents. A remote audit cannot see dashboard settings and does not impersonate bots, so this is a manual check. Signed agents can be recognised with Web Bot Auth (web-bot-auth.verify).

How to implement

1. In Cloudflare Security Settings, review Configure AI bot policies: Search, Agent and Training.
2. For shops, keep Search and Agent allowed at least on product pages; choose Training separately.
3. Review AI Crawl Control for blocked crawlers and robots.txt violations.
4. If managed robots.txt is on, check the rules it prepends.

Depends on access.robots.search-and-user-agents

Resources

• Cloudflare: Block AI bots and AI bot policies (opens in new tab) Cloudflare docs
• Cloudflare: AI Crawl Control (opens in new tab) Cloudflare docs
• Cloudflare: managed robots.txt (opens in new tab) Cloudflare docs
• Cloudflare: Web Bot Auth (opens in new tab) Cloudflare docs

Audit

Method platform_console human check

Cloudflare dashboard: AI bot policies and AI Crawl Control match your robots.txt choices; Agent and Search not blocked on product pages.

access.cloudflare.ai-bots JSON