ACP vs UCP vs the OpenAI Merchant Feed: the agentic-commerce protocol field guide

Three protocols now govern the layer where AI agents transact with merchants: the Agentic Commerce Protocol (ACP), the Universal Commerce Protocol (UCP), and x402. They address different problems — checkout completion, full lifecycle management, and machine-native payment settlement respectively — and they are not mutually exclusive. Picking the wrong starting point means either missing the buyers already in ChatGPT or building a checkout flow for a surface that does not yet have meaningful agent traffic. This document maps each protocol, its discovery surface, its payment model, and the conditions under which it belongs at the top of your implementation queue.

Protocol comparison

What each protocol actually does

ACP: checkout inside the agent surface

ACP is an OpenAI-and-Stripe joint specification, initially released September 29 2025 and now stable at the 2026-04-17 spec version ⁵¹⁵. Its scope is deliberately narrow: it defines four REST endpoints (create, update, complete, cancel) on a merchant server, a Stripe Shared Payment Token exchange for handling payment credentials, and a delegated OAuth 2.0 flow so that a ChatGPT agent can act on a buyer's behalf ¹. Merchants render checkout within ChatGPT's interface while remaining merchant of record. In February 2026, ChatGPT Instant Checkout went live using ACP, exposing this flow to ChatGPT's 900M weekly active users ¹².

The OpenAI Merchant Feed is the discovery half of the same system. Products reach ChatGPT shopping carousels not through crawling but through a structured daily feed — JSONL.gz, CSV.gz, or Parquet — pushed to an OpenAI SFTP endpoint. Required fields include feed_id, account_id, target_merchant, country, product_id, variant_id, pricing, and availability. Two boolean flags control visibility: is_eligible_search (carousel inclusion) and is_eligible_checkout (Instant Checkout activation) ¹³. Stale inventory in the feed is an automatic exclusion risk, not a ranking penalty — the feed supports a 15-minute refresh cadence ¹³. The feed has no public crawl surface; access requires merchant approval by OpenAI ¹¹.

UCP: full lifecycle via an open standard

UCP launched January 11 2026 as a co-developed open standard from Google and Shopify, with a coalition of 13+ industry backers spanning Amazon, American Express, Meta, Microsoft, Salesforce, Stripe, Target, Visa, and Walmart ⁶²¹. Its scope extends across the entire commerce lifecycle: catalog search, product lookup, cart management, checkout, identity linking, and order tracking. UCP defines capability modules — dev.ucp.shopping.catalog.search, dev.ucp.shopping.catalog.lookup, dev.ucp.shopping.checkout, dev.ucp.shopping.identity, dev.ucp.shopping.order — and allows merchants to publish which subset they support ⁸.

The protocol ships both MCP (Model Context Protocol) and REST bindings, using JSON-RPC 2.0 transport. Every request in the MCP binding must include a meta object with a ucp-agent field for agent identification ⁷. The canonical discovery surface is a manifest published at /.well-known/ucp. This is the first standard /.well-known/ endpoint in agentic commerce — agents that speak UCP know to look here first before querying any capability endpoint ⁸. As of May 2026, UCP is live across Google AI Mode, Gemini, ChatGPT's in-app browser, and Microsoft Copilot, with AI-sourced orders on Shopify up 15× year-over-year since the January launch ¹⁴.

x402: machine payments over HTTP

x402 operates at a different layer than ACP and UCP. Rather than defining a commerce workflow, it revives the long-dormant HTTP 402 Payment Required status code as a machine-native settlement primitive ¹⁶. A server returns a 402 response containing a PAYMENT-REQUIRED header with Base64-encoded JSON specifying price, token, chain, and recipient wallet. The client signs a payment payload and retries with a PAYMENT-SIGNATURE header. A facilitator — Coinbase CDP hosts the production version — verifies the signature and settles on-chain, completing in approximately 1–2 seconds with no protocol fees and roughly $0.0001 in gas costs ²⁵.

By April 2026, x402 had processed 165M+ agent transactions with $50M in monthly volume. A widely-repeated $600M+ cumulative figure circulates across the ecosystem, but it originates from a promotional industry source and has not been independently confirmed — treat it as directional, not audited ¹⁸. Active integrations include AWS AgentCore Payments (Amazon Bedrock agents), Solana Pay.sh on Google Cloud, Browserbase, and Coinbase Commerce ¹⁶. The x402 Foundation — a Linux Foundation project — governs the spec, with TypeScript, Python, and Go SDKs shipped under Apache-2.0 ¹⁷. What x402 does not handle: subscriptions, invoicing, dispute resolution at the protocol level, or consumer wallet UX. The dominant exact scheme is irreversible once on-chain; the auth-capture scheme (x402r) adds escrow-based refunds but remains outside the Foundation spec ²⁵.

Discovery surfaces: the new shelf

Where traditional retail shelf space is governed by placement fees and retailer relationships, agentic shelf space is governed by machine-readable discovery surfaces. Each protocol defines a different entry point for agents.

• **ACP / OpenAI Merchant Feed**: No public crawl surface. Visibility requires active merchant enrollment with OpenAI and daily structured feed delivery to a permissioned SFTP endpoint. Agents operating within ChatGPT discover products through the feed index, not through web crawling ¹¹¹³.
• **UCP**: The /.well-known/ucp manifest is a JSON document published at a predictable path on the merchant domain. It declares which capability modules the merchant supports and where the MCP or REST endpoints live. An agent that finds /.well-known/ucp can immediately determine whether a merchant supports catalog search, checkout, or identity linking without any prior enrollment ⁷⁸.
• **x402**: Discovery is implicit in the HTTP response itself. When a client requests a resource and receives a 402, the PAYMENT-REQUIRED header is the discovery signal. Coinbase's Bazaar directory provides an opt-in layer for buyers to find x402-enabled endpoints, but it is on the roadmap rather than shipped ²⁵.

The /.well-known/ convention matters because it is agent-navigable without prior coordination. A UCP-capable agent visiting an unknown merchant domain can check /.well-known/ucp in one request and know precisely what commerce actions are available. ACP's absence of an equivalent discovery surface means ACP merchants are only reachable through OpenAI's walled-garden index. x402's discovery model is reactive rather than declarative — it is designed for APIs, not for browsable storefronts.

# Example: /.well-known/ucp manifest (UCP capability declaration)
# Published at https://example-merchant.com/.well-known/ucp

{
  "version": "2026-01",
  "merchant": {
    "id": "merchant_abc123",
    "name": "Example Merchant"
  },
  "capabilities": [
    "dev.ucp.shopping.catalog.search",
    "dev.ucp.shopping.catalog.lookup",
    "dev.ucp.shopping.checkout",
    "dev.ucp.shopping.identity",
    "dev.ucp.shopping.order"
  ],
  "endpoints": {
    "mcp": "https://example-merchant.com/ucp/mcp",
    "rest": "https://example-merchant.com/ucp/v1"
  },
  "authentication": {
    "type": "oauth2",
    "authorization_endpoint": "https://example-merchant.com/oauth/authorize"
  }
}

Payment rails: how money moves

ACP routes payment through Stripe Shared Payment Tokens. A buyer's payment credential — stored with Stripe — is passed to the merchant via a token exchange during the checkout session. The merchant charges the token without ever receiving raw card data ¹. This model works for the ChatGPT-in-app-browser context where users have payment methods on file with OpenAI or Stripe. In Q1 2026, OpenAI announced a shift from "checkout in ChatGPT" toward an app-based model; the final architecture of that shift is not yet documented ⁵.

UCP separates the checkout protocol from the payment processor. Merchants can accept Stripe, Adyen, or PayPal via a Payment Token Exchange model, keeping UCP itself payment-agnostic ³. For merchants already using Shopify Payments, the default path is Shopify processing with AI-channel attribution passed through to the merchant admin ¹⁴.

x402 settles in USDC on Base or Solana — typically in 1–2 seconds at near-zero protocol cost ¹⁶. The settlement is irreversible under the dominant exact scheme ²⁵. This makes x402 well-suited for agent-to-API micropayments (data access, compute, content) where the parties are software systems. It is poorly suited for consumer-facing retail where dispute resolution, refunds, and cross-border tax handling are mandatory. Bags and similar merchant-of-record services wrap x402 with compliance layers, but these are not part of the protocol spec.

What is not yet standardized

Three gaps are material for implementation decisions as of June 2026.

• **Cross-protocol discovery**: No unified discovery layer exists. An ACP-only merchant has no /.well-known/ endpoint; a UCP merchant has no signal visible to ACP-only agents. The gap means merchants need to implement both to reach all agent surfaces, and agents need protocol-specific logic to query each ²⁰.
• **Pricing negotiation**: All three protocols assume fixed pricing. No standard supports dynamic pricing, bulk discounts, B2B contract pricing, or agent-mediated counter-offers ¹⁰. UCP defines a Discounts extension; ACP includes discount objects; neither standardizes counter-offer flows.
• **Behavioral certification**: No standard exists for certifying that an AI agent respects return policies, passes fraud thresholds, or meets a merchant's acceptance criteria. Stripe Radar provides fraud scoring for ACP flows but it is Stripe-specific, not protocol-level ¹. This gap is the primary reason most UCP and ACP implementations require human confirmation before transaction completion.

Implementation notes

The architecture that scales across all three protocols is a single normalized product catalog that emits to each protocol's required format. ACP and the OpenAI Merchant Feed share the same product data model; a Parquet feed covering required fields (feed_id, account_id, target_merchant, country, product_id, variant_id, title, price, availability) satisfies the Merchant Feed and provides the inventory state ACP checkout needs in real time ⁴¹³. UCP adds cart and identity capability modules on top of the same catalog via its MCP or REST binding; a merchant implementing UCP MCP does not need to rebuild their catalog schema, only expose it through the UCP endpoint structure ⁷.

Data freshness is a production constraint across all three. Stale inventory in the OpenAI Merchant Feed causes automatic exclusion from ChatGPT carousels, not degraded ranking ¹³. UCP's Catalog capability queries inventory in real time; a response showing an out-of-stock item while the feed still shows available is a transaction failure ⁷. x402 settlement is irreversible — an agent that pays for access to stale data has no protocol-level recourse. The practical requirement: product data sync latency should be sub-two-hours for feeds and real-time for capability endpoint responses.

Schema strictness distinguishes agent-readable product data from SEO-optimized pages. ACP and UCP require machine-parsable fields with consistent data types — price as a decimal with currency code, not a formatted string — and mandate that product_id and variant_id never change across updates ¹³. AI agents extract structured data from server-rendered responses; JavaScript-rendered product pages are not visible to LLM crawlers that do not execute JS. This makes schema.org structured data in server-rendered HTML a baseline, not an optimization.

The emerging layered stack

As of May 2026, four payment protocols co-exist without eliminating each other: AP2 (Google's cryptographic authorization layer, 60+ partners), ACP (OpenAI/Stripe checkout), x402 (settlement), and MPP (Stripe/Tempo micropayment streaming, launched March 2026) ⁵²⁴. The architecture pattern that has emerged in production implementations stacks them: AP2 handles signed authorization mandates; ACP or UCP handles the checkout session; x402 or MPP handles settlement. This is additive rather than competitive — none of these protocols has absorbed the others as of this writing ¹⁹²².

Shipped vs emerging: an honest ledger

What to watch

Three signals indicate when the protocol landscape is consolidating enough to reduce implementation complexity. First: whether a unified /.well-known/ discovery format emerges that spans ACP and UCP, eliminating the dual-enrollment requirement for full agent surface coverage. Second: whether x402's auth-capture scheme is absorbed into the Foundation spec, making irreversibility no longer a merchant-side risk assumption. Third: whether OpenAI's app-based ACP model produces a public specification that allows non-ChatGPT agents to use ACP endpoints. Until those signals resolve, the practical posture is UCP as the open-standard baseline, ACP plus the OpenAI Merchant Feed for ChatGPT-specific reach, and x402 scoped to agent-to-API use cases where crypto settlement is already expected by the counterparty.