Embedded Checkout & Universal Commerce Protocol

UCP

Universal Commerce Protocol

Announced January 11, 2026—a protocol for agent commerce

1-click

Merchant Activation

Catalog available on all agent surfaces with one toggle

The Shift

Product discovery is collapsing. The journey that used to take 10-15 touchpoints—browsing, comparing, reading reviews, abandoning carts, coming back—is now 4-5. Someone asks an AI assistant for a recommendation, gets one, and buys it.

This changes everything about how commerce works. And it raises a hard question: when a purchase happens inside an agent, whose checkout runs?

The obvious answer is to build an API. The agent calls some endpoints, passes payment info, completes the transaction. Stripe and OpenAI pursued this with MCP. It works for simple cases.

But commerce isn't simple. Merchants have business rules. A European regulation requires a checkbox confirming the buyer read the terms. A furniture store needs buyers to select from specific pickup locations. A merchant selling age-restricted products needs date of birth verification. These aren't edge cases—they're the reality of commerce at scale.

You could try to model all of this in an API. But the tail is very fat. At some point, the right answer is: show the merchant's actual checkout.

The Protocol

On January 11, 2026, we announced the Universal Commerce Protocol—a standard for how agents discover products, initiate purchases, and complete transactions across any merchant, Shopify or otherwise.

The key mechanism is what we call "requires escalation." Most transactions can complete over pure data exchange. But when they can't—when the merchant needs their checkout rendered in whatever context the agent is operating in—the protocol signals escalation. That's when embedded checkout kicks in.

APIs are specific implementations of a protocol. The embedded checkout protocol defines an interface schema—the messaging between a parent context and the checkout frame, what events flow back and forth, what data gets exchanged. When Shopify implements it, there's an API using postMessage in JavaScript. But the protocol itself is a broader concept that any checkout on the internet could implement.

This matters because we're not trying to lock commerce into Shopify. We're trying to define a standard that makes agent commerce work for everyone—merchants, platforms, buyers. The protocol is the contract. Implementations can vary.

Why Web-Only

Shopify checkout is a web implementation rendered via iframe or webview. We don't build native checkout implementations.

This is the same fat tail logic. If we built native checkout, every merchant customization would need native support. Every checkbox, every pickup point selector, every custom field. The surface area would be enormous and perpetually incomplete.

Web-only means the merchant's checkout—with all its customizations, all its apps, all its business logic—just works. The embedded context renders it. postMessage handles the communication. The merchant doesn't have to do anything different.

postMessage is the universal language for an iframe or webview talking to its parent. On iOS, you connect delegates that listen to these messages. On Android, similar patterns. On web, it's native.

There aren't really alternatives. This is just the standard for cross-frame communication. The interesting design work is in what messages get sent—the schema, the events, the handshakes. That's what the protocol defines.

What Partners Taught Us

Almost every partner we worked with came wanting an API-only solution. Call some endpoints, complete checkout, done. That was the prevailing model.

We convinced them that commerce has a fat tail. Modeling everything over API is fragile. You need escape hatches for the cases that don't fit.

What they taught us was about consistency. A single merchant has consistent checkout. But partners are rendering checkouts across thousands of Shopify merchants. Their branding, their user experience—that has to feel consistent whether the user is in the partner's native app or in an embedded checkout.

So flexibility became critical. We built support for cleaner designs, different section styling, customizable order summaries. We optimized for single-item transactions—agents typically buy one thing at a time, and our checkout was built for arbitrary cart sizes but not optimized for one.

💡

Partners wanted API-only. We convinced them of the fat tail. They taught us about brand consistency across merchants and single-item optimization. The protocol evolved from both directions.

The Merchant Experience

For merchants, this is one toggle. Turn it on, and your catalog is discoverable by any agent that supports UCP. Your checkout works in any context that implements the embedded protocol. Your business rules are respected.

No per-channel integration. No figuring out which agent platforms to partner with. No managing multiple relationships. Default on: everything you need for agent commerce to work.

This is the distribution unlock. Merchants get access to every agent surface that supports the protocol. Agent platforms get access to every merchant catalog. The protocol is the connective tissue.

The Bet

Two things matter. First: merchant business rules have to be respected. When an agent acts on behalf of a buyer, the merchant's needs still get fulfilled. Checkout customizations still run. Business logic still applies. That's non-negotiable—it's the core of Shopify's business.

Second: merchants have to participate in the collapsed discovery flow. If product discovery moves to agents and merchants aren't there, they lose. Making our global catalog available in one go, with a protocol that respects merchant rules on any surface—that's the winning position.

Faster and better for consumers. No compromises for merchants. Because high-quality merchants are what create consumer surplus in the first place. Platforms can optimize, but merchants are the source.

The future of checkout isn't a page on a website. It's a protocol that can run anywhere—inside an agent, an app, a conversation—while still being the merchant's checkout, with all their rules intact.