TechPrufer
Get started
Google
Google logoGoogle · Feature trail

Universal Commerce Protocol (UCP)

2 posts · Jun 2025 – May 2026

What this trail covers

The Universal Commerce Protocol (UCP) continues to evolve as an open-source standard for agentic commerce. This post details the integration of Google Pay and Wallet Developer MCP server, simplifying integration workflows for AI agents and accelerating time to first transaction. Existing Google Pay backends and Merchant IDs are compatible with UCP, enabling agentic commerce experiences without rebuilding core payment logic. New callbacks on Android streamline checkout, and support expands to soc. This post details how to use a sandboxed iframe to integrate Google Pay into PCI DSS v4 compliant checkout pages, addressing the challenge of dynamic script hashing.

All Google trails
  1. Supercharge your integration workflow with the Google Pay & Wallet Developer MCP server- Google Developers BlogIntroduces the Google Pay & Wallet Developer MCP server, which provides tools for AI agents to interact with Google Pay & Wallet APIs. This server enables AI assistants to perform tasks such as searching documentation via RAG, accessing account and integration details, validating Wallet pass JWTs/JSON, monitoring performance metrics, and managing integrations (creating merchant accounts, registering integrations). This aims to streamline the integration workflow by minimizing context switching and improving accuracy.
  2. The latest updates to Google Pay- Google Developers BlogThis post details the integration of Google Pay and Wallet with the Universal Commerce Protocol (UCP) to support agentic commerce. It introduces the Google Pay & Wallet Developer MCP server for AI agent integration, new onPaymentAuthorized and onPaymentDataChanged callbacks for Android to enable 1-click Express checkout and dynamic payment sheet updates, and expanded WebView integration for social apps. New tools for transaction routing transparency include the cardFundingSource signal and eftpos routing in Australia. Lifecycle notifications for Merchant-Initiated Transactions (MITs) are introduced to ensure continuity for recurring billing. Cross-Device Authentication is presented as a method to move high-friction desktop checkouts to mobile-first authentication flows.
  3. Under the Hood: Universal Commerce Protocol (UCP)- Google Developers BlogThis post introduces the Universal Commerce Protocol (UCP) as an open-source standard for agentic commerce, detailing its architecture, benefits for businesses, AI platforms, developers, payment providers, and consumers. It outlines a unified integration approach, a shared language for commerce, an extensible architecture, and a security-first approach with tokenized payments and verifiable credentials. The post provides a practical walkthrough of setting up a business server, preparing it for agent requests, discovering business capabilities via a UCP manifest, and invoking checkout and discount capabilities using cURL commands. It highlights the separation of payment instruments from handlers and support for multiple transports like A2A, MCP, and APIs.
  4. Google Cloud donates A2A to Linux Foundation- Google Developers BlogGoogle has donated its Agent2Agent (A2A) protocol specification, accompanying SDKs, and developer tooling to the Linux Foundation to form the new Agent2Agent project. This initiative aims to foster an open and interoperable ecosystem for AI agents, establishing A2A as an industry standard for AI agent communication and collaboration. The project will be managed under the neutral governance of the Linux Foundation to ensure vendor-agnosticism and community-driven development.
  5. Google Pay inside sandboxed iframe for PCI DSS v4 compliance- Google Developers BlogIntroduces a method for integrating Google Pay into PCI DSS v4 compliant checkout pages by using a sandboxed iframe. This addresses the challenge of dynamic script hashing for Google Pay's pay.js, which prevents the use of Subresource Integrity (SRI). The solution involves embedding pay.js within an iframe with specific sandbox attributes (`allow-scripts`, `allow-popups`, `allow-same-origin`, `allow-forms`) and using `window.postMessage()` for communication with the parent page. Highlights Shopify's successful implementation and PCI DSS v4 audit pass using this technique.