Auth for UCP

Secure Universal Commerce Protocol (UCP) servers with Auth0, enabling AI agents like Google Gemini to discover, link accounts, and check out on behalf of verified shoppers.

The Universal Commerce Protocol (UCP) is an open standard that provides AI agents a consistent way to interact with a merchant’s catalog, cart, and checkout. While UCP defines what agents can buy and how commerce flows work, it does not define who the agent is, which shopper it acts for, or what it is allowed to do. Auth for UCP fills that gap by adding an identity and authorization layer to your UCP server using your existing Auth0 tenant.

With Auth for UCP, you can:

• Publish your UCP scopes so agents can discover them from your tenant’s standard OAuth and OIDC metadata.
• Link a shopper using an agent platform to their account on your site using standard OAuth account linking.
• Tie purchases to a verified shopper, so agents can use order history, loyalty points, and eligible coupons rather than treating checkout as anonymous.

The merchant decides whether to trust an AI agent platform, and is responsible for where tokens go once issued. Don’t add personal data to the custom claims of UCP access tokens.

Use cases

• Sell through AI assistants as a new sales channel: Let shoppers discover, compare, and buy from your brand inside agent platforms such as Gemini, with checkout tied to a verified user identity.
• Personalize agent-assisted shopping: Link the shopper using the agent to their account on your site, so the agent can use their order history, credit loyalty points, and apply eligible coupons instead of treating every checkout as anonymous.
• Control what agents can request: Publish only the UCP scopes your server supports, and authorize each agent platform with a client grant, so agents can only request access you’ve approved.

Who this is for

Auth for UCP is for merchants that build and operate their own UCP server and need a standards-compliant authorization layer. If you use an e-commerce platform that provides built-in UCP support, you likely don’t need to configure this yourself.

How it works

Auth0 supports the flows that UCP agents use today. You choose which to enable based on your user experience.

Flow	When it’s used	Auth0 behavior
Guest access	A shopper buys as a guest, with no account created or linked.	The agent platform uses the client credentials grant against your UCP resource server. Auth0 treats it like any other API that allows machine-to-machine (M2M) access, so no UCP-specific configuration is required.
Standard account linking	A shopper has an account with you or creates one. The agent platform shows a consent screen, then redirects the shopper to your Auth0 tenant.	Authorization code flow for public and confidential clients (PKCE for public clients), using the scopes you publish for your UCP server.

To support guest checkout, authorize the application representing the agent platform to use the client credentials grant against your UCP resource server. If you don’t want to allow guest checkout, don’t authorize that grant.

Auth0 models the pieces of a UCP integration with existing concepts:

UCP concept	Auth0 concept
The agent platform, such as Gemini	A first-party or third-party application, can be public or confidential
Your UCP server	An API (resource server) with the UCP resource server type
UCP scopes such as dev.ucp.shopping.checkout:manage	API permissions (scopes)
Permission for the agent platform to call your UCP server	Required for third-party applications: a client grant between the application and the API

Get started

To secure your UCP server with Auth0:

1. Configure your UCP resource server and publish scopes to discovery metadata.
2. Set up standard account linking for the authorization code flow.

Limitations

Auth for UCP in Early Access has the following limits:

• Only one API per tenant can be configured as the UCP resource server, and only that API’s scopes are published to discovery metadata.
• dev.ucp scopes cannot be created on non-UCP servers.
• dev.ucp scopes cannot be added to non-UCP servers via the login action’s api.accessToken.setScope() command.
• Agent platforms send scope but not audience, so Auth0 uses the tenant default audience for UCP flows.
• Auth0 Organizations aren’t supported.

Learn more

• Scope discovery metadata
• Management API configuration