{"id":335249,"date":"2026-07-15T05:23:47","date_gmt":"2026-07-15T05:23:47","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/ucp-enabler-for-woocommerce\/"},"modified":"2026-10-01T11:55:10","modified_gmt":"2026-10-01T11:55:10","slug":"wt-ucp-enabler-for-woocommerce","status":"publish","type":"plugin","link":"https:\/\/id.wordpress.org\/plugins\/wt-ucp-enabler-for-woocommerce\/","author":15888981,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.5","stable_tag":"1.0.5","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"WebToffee Universal Commerce Protocol Enabler for Woocommerce","header_author":"WebToffee","header_description":"Exposes your WooCommerce store as a Universal Commerce Protocol (UCP) business \u2014 serving a \/.well-known\/ucp discovery profile and REST endpoints for Checkout, Cart, Order, and Catalog capabilities so AI agents can shop your store.","assets_banners_color":"270f46","last_updated":"2026-10-01 11:55:10","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/www.webtoffee.com\/","header_author_uri":"https:\/\/www.webtoffee.com\/","rating":0,"author_block_rating":0,"active_installs":10,"downloads":549,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"webtoffee","date":"2026-07-15 05:23:10","revision":3608263},"1.0.1":{"tag":"1.0.1","author":"webtoffee","date":"2026-07-22 12:30:44","revision":3618574},"1.0.2":{"tag":"1.0.2","author":"webtoffee","date":"2026-08-10 04:16:50","revision":3639936},"1.0.3":{"tag":"1.0.3","author":"webtoffee","date":"2026-08-18 09:13:10","revision":3652349},"1.0.4":{"tag":"1.0.4","author":"webtoffee","date":"2026-08-27 06:04:20","revision":3668163},"1.0.5":{"tag":"1.0.5","author":"webtoffee","date":"2026-10-01 11:55:10","revision":3723039}},"upgrade_notice":{"1.0.5":"<p>Implements UCP 2026-08-25. Platforms must send the standard UCP-Agent header and use protocol 2026-08-25 or 2026-04-08. New checkout sessions use opaque ids (no X-UCP-Session-Token). Generate a signing key for signed responses and order webhooks.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3608540,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3608540,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3608808,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3608808,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"<strong>WooCommerce \u2192 UCP Enabler \u2014 General<\/strong> \u2014 endpoints, cache, UCP-Agent requirement, capabilities and signing keys.","2":"<strong>Payment Handler tab<\/strong> \u2014 Stripe handler status or PSP tokenizer credentials.","3":"<strong>Embedded tab<\/strong> \u2014 trusted host origins and delegations.","4":"<strong>\/.well-known\/ucp<\/strong> \u2014 the live discovery profile served by the plugin."}},"plugin_section":[],"plugin_tags":[271422,3148,23853,254710,286],"plugin_category":[45],"plugin_contributors":[153972],"plugin_business_model":[],"class_list":["post-335249","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-commerce","plugin_tags-checkout","plugin_tags-rest-api","plugin_tags-ucp","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-webtoffee","plugin_committers-webtoffee"],"banners":{"banner":"https:\/\/ps.w.org\/wt-ucp-enabler-for-woocommerce\/assets\/banner-772x250.png?rev=3608808","banner_2x":"https:\/\/ps.w.org\/wt-ucp-enabler-for-woocommerce\/assets\/banner-1544x500.png?rev=3608808","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/wt-ucp-enabler-for-woocommerce\/assets\/icon-128x128.png?rev=3608540","icon_2x":"https:\/\/ps.w.org\/wt-ucp-enabler-for-woocommerce\/assets\/icon-256x256.png?rev=3608540","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>WebToffee Universal Commerce Protocol Enabler for Woocommerce<\/strong> integrates your store with the <a href=\"https:\/\/ucp.dev\">Universal Commerce Protocol<\/a> \u2014 the open standard that lets AI assistants (Google AI Mode, Gemini, ChatGPT, and others) discover, browse, and purchase from your store without custom builds for each platform.<\/p>\n\n<p>This version implements <strong>UCP 2026-08-25<\/strong> and also serves platforms still on <strong>UCP 2026-04-08<\/strong>.<\/p>\n\n<p>Once activated:<\/p>\n\n<ol>\n<li><strong>A discovery profile is published at <code>\/.well-known\/ucp<\/code><\/strong> \u2014 the standard entry point AI platforms fetch to learn what your store supports: its services (REST, MCP, A2A, Embedded), capabilities, payment handlers, and the public keys it signs with.<\/li>\n<li><strong>REST endpoints go live at <code>\/wp-json\/wt-ucp\/v1\/<\/code><\/strong>, plus an MCP endpoint (<code>\/wp-json\/wt-ucp\/v1\/mcp<\/code>) and an A2A agent (<code>\/.well-known\/agent-card.json<\/code>).<\/li>\n<\/ol>\n\n<p>Every request is <strong>negotiated<\/strong>: the calling platform names its own UCP profile in the <code>UCP-Agent<\/code> header (or, over MCP, in <code>meta[\"ucp-agent\"].profile<\/code>). The store fetches that profile (securely, and cached), checks that it speaks UCP 2026-08-25 or 2026-04-08, and serves only the capabilities both sides support, in that version's format.<\/p>\n\n<h4>Capabilities<\/h4>\n\n<p><strong>Checkout<\/strong> (<code>dev.ucp.shopping.checkout<\/code>)\nCheckout sessions are real WooCommerce orders. An agent creates a session with line items, adds the buyer and shipping details, and completes it with a payment instrument. The session reports where it stands \u2014 <code>incomplete<\/code> (with messages saying what's missing), <code>ready_for_complete<\/code>, <code>requires_escalation<\/code> (the buyer must finish on your store, e.g. 3-D Secure), <code>completed<\/code>, or <code>canceled<\/code> \u2014 and always carries a <code>continue_url<\/code> that opens <em>the same order<\/em> on your WooCommerce checkout for the buyer.<\/p>\n\n<p><strong>Fulfillment<\/strong> (<code>dev.ucp.shopping.fulfillment<\/code>, extends Checkout)\nAgents submit a shipping address and get back the rates your own WooCommerce shipping zones return (flat rate, free shipping, table rates\u2026), pick one, and the charge is added to the order. Without this extension, checkouts for physical products hand the buyer off to your checkout page.<\/p>\n\n<p><strong>Cart<\/strong> (<code>dev.ucp.shopping.cart<\/code>)\nBasket building before purchase intent, priced by WooCommerce's own cart engine (coupons, and tax estimates when the agent supplies a location). Carts convert to checkouts with <code>cart_id<\/code>, and have a shareable <code>continue_url<\/code> that loads them into the shopper's WooCommerce cart.<\/p>\n\n<p><strong>Order<\/strong> (<code>dev.ucp.shopping.order<\/code>)\n    GET \/orders\/{id} returns the placed order \u2014 line items with ordered\/active\/fulfilled quantities, fulfillment expectations, refunds and cancellations as adjustments. When the platform's profile provides a <code>webhook_url<\/code>, the store also pushes <strong>signed order webhooks<\/strong> (order created, then every change).<\/p>\n\n<p><strong>Catalog<\/strong> (<code>dev.ucp.shopping.catalog.search<\/code>, <code>dev.ucp.shopping.catalog.lookup<\/code>)\nProduct search with category and price filters and cursor pagination, batch lookup by product\/variant id or SKU, and single-product detail with interactive variant selection. Every product lists its purchasable variants (simple products are their own single variant), with prices, sale (list) prices, stock availability, options, images, categories and ratings.<\/p>\n\n<p><strong>Discount<\/strong> (<code>dev.ucp.shopping.discount<\/code>, extends Cart and Checkout)\nAgents submit coupon codes in <code>discounts.codes<\/code>; WooCommerce validates and applies them, and the response lists every applied discount (including automatic ones) with per-line allocations. Rejected codes come back as typed warnings (<code>discount_code_expired<\/code>, <code>discount_code_user_ineligible<\/code>, \u2026).<\/p>\n\n<p><strong>Identity Linking<\/strong> (<code>dev.ucp.common.identity_linking<\/code>)\nAn OAuth 2.0 authorization server (Authorization Code + PKCE) that lets a platform act for a signed-in shopper's own account. Off by default; you choose which operations require a linked account (<code>dev.ucp.shopping.order:read<\/code>, <code>dev.ucp.shopping.checkout:manage<\/code>).<\/p>\n\n<h4>REST Endpoints<\/h4>\n\n\n\n\n  Method\n  Path\n  Capability\n\n\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/catalog\/search<\/code>\n  Catalog\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/catalog\/lookup<\/code>\n  Catalog\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/catalog\/product<\/code>\n  Catalog\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/carts<\/code>\n  Cart\n\n\n  GET\n  <code>\/wp-json\/wt-ucp\/v1\/carts\/{id}<\/code>\n  Cart\n\n\n  PUT\n  <code>\/wp-json\/wt-ucp\/v1\/carts\/{id}<\/code>\n  Cart\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/carts\/{id}\/cancel<\/code>\n  Cart\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/checkout-sessions<\/code>\n  Checkout\n\n\n  GET\n  <code>\/wp-json\/wt-ucp\/v1\/checkout-sessions\/{id}<\/code>\n  Checkout\n\n\n  PUT\n  <code>\/wp-json\/wt-ucp\/v1\/checkout-sessions\/{id}<\/code>\n  Checkout\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/checkout-sessions\/{id}\/complete<\/code>\n  Checkout\n\n\n  POST\n  <code>\/wp-json\/wt-ucp\/v1\/checkout-sessions\/{id}\/cancel<\/code>\n  Checkout\n\n\n  GET\n  <code>\/wp-json\/wt-ucp\/v1\/orders\/{id}<\/code>\n  Order\n\n\n\n\n<p>State-changing operations honour the <code>Idempotency-Key<\/code> header: a retry with the same key and body returns the original result; the same key with a different body is rejected with <code>409<\/code>.<\/p>\n\n<p>Checkout-completion and order responses are signed (RFC 9421 HTTP Message Signatures) once a signing key exists \u2014 generate one under <strong>General \u2192 Signing Keys<\/strong>.<\/p>\n\n<h4>Settings<\/h4>\n\n<p>Go to <strong>WooCommerce \u2192 UCP Enabler<\/strong> to configure:<\/p>\n\n<ul>\n<li><strong>General<\/strong> \u2014 API base endpoint (for proxied setups), MCP endpoint, profile cache TTL, whether requests must carry <code>UCP-Agent<\/code>, capability toggles, and message signing keys (generate\/rotate\/revoke).<\/li>\n<li><strong>Payment Handler<\/strong> \u2014 The Stripe Payment Handler (auto-detected when the official WooCommerce Stripe Gateway extension is active) or a generic PSP tokenizer.<\/li>\n<li><strong>Embedded<\/strong> \u2014 Embedded Checkout\/Cart, trusted host origins, and which delegations hosts may ask for.<\/li>\n<li><strong>Identity Linking<\/strong> \u2014 The OAuth 2.0 authorization server, gated scopes, and registered platform apps.<\/li>\n<\/ul>\n\n<h4>Payment Processing<\/h4>\n\n<p>A completion request must carry exactly one payment instrument whose <code>handler_id<\/code> is one you advertise; raw card numbers are refused. The charge itself is delegated to the <code>wbte_ucp_enabler_process_payment<\/code> filter:<\/p>\n\n<pre><code>php\nadd_filter( 'wbte_ucp_enabler_process_payment', function( $result, $order, $instrument, $credential ) {\n    if ( null !== $result || 'my_handler' !== $instrument['handler_id'] ) {\n        return $result; \/\/ Not mine.\n    }\n    \/\/ Charge $credential['token'] with your gateway, then:\n    \/\/   success       \u2192 $order-&gt;payment_complete( $transaction_id ); return true;\n    \/\/   decline       \u2192 return new WP_Error( 'payment_failed', 'Card declined.' );\n    \/\/   3-D Secure    \u2192 return new WP_Error( 'requires_3ds', 'Authenticate.', array( 'redirect_url' =&gt; $challenge_url ) );\n    return true;\n}, 10, 4 );\n<\/code><\/pre>\n\n<p>For the built-in generic PSP tokenizer with no charge integration hooked in, the order is placed <strong>on hold<\/strong> with the token stored for manual capture.<\/p>\n\n<h4>Buyer Handoff<\/h4>\n\n<p>Every open checkout carries a <code>continue_url<\/code>. Opening it rebuilds the checkout in the shopper's WooCommerce cart (items, coupons, addresses, the chosen shipping rate) and continues on your normal checkout page \u2014 Classic or Blocks \u2014 <strong>paying for the same order<\/strong>, so the agent sees the session complete. Carts have an equivalent, shareable <code>continue_url<\/code>.<\/p>\n\n<h4>Item ID Convention<\/h4>\n\n<ul>\n<li><code>\"123\"<\/code> \u2192 WooCommerce product 123 (a simple product is its own variant)<\/li>\n<li><code>\"123-456\"<\/code> \u2192 WooCommerce product 123, variation 456<\/li>\n<\/ul>\n\n<p>Catalog responses return variant ids in this format so agents can use them directly as <code>line_items[].item.id<\/code>. Lookup also accepts SKUs. Override with the <code>wbte_ucp_enabler_resolve_item_id<\/code> filter.<\/p>\n\n<h4>Developer Hooks<\/h4>\n\n<ul>\n<li><code>wbte_ucp_enabler_profile<\/code> \u2014 filter the published profile.<\/li>\n<li><code>wbte_ucp_enabler_business_capabilities<\/code> \u2014 add\/adjust capabilities (used for both the profile and negotiation).<\/li>\n<li><code>wbte_ucp_enabler_payment_handlers<\/code> \/ <code>wbte_ucp_enabler_payment_handlers_response<\/code> \u2014 advertise payment handlers (profile and checkout responses \/ responses only).<\/li>\n<li><code>wbte_ucp_enabler_process_payment<\/code> \u2014 charge a submitted instrument.<\/li>\n<li><code>wbte_ucp_enabler_checkout_readiness_messages<\/code> \u2014 add requirements that keep a checkout from <code>ready_for_complete<\/code>.<\/li>\n<li><code>wbte_ucp_enabler_checkout<\/code>, <code>wbte_ucp_enabler_order<\/code>, <code>wbte_ucp_enabler_catalog_product<\/code> \u2014 filter response resources.<\/li>\n<li><code>wbte_ucp_enabler_links<\/code>, <code>wbte_ucp_enabler_policies<\/code> \u2014 legal links and structured policies on checkout\/cart\/order.<\/li>\n<li><code>wbte_ucp_enabler_embedded_implemented_delegations<\/code> \u2014 delegations your embedded checkout page actually wires.<\/li>\n<li><code>wbte_ucp_enabler_allow_platform_host<\/code>, <code>wbte_ucp_enabler_platform_profile_request_args<\/code> \u2014 control platform-profile fetching.<\/li>\n<li><code>wbte_ucp_enabler_checkout_completed<\/code> (action) \u2014 fires when a checkout session completes.<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>This plugin does not send any data to WebToffee. Its purpose is to let AI shopping platforms that implement the Universal Commerce Protocol (Google AI Mode, Gemini, ChatGPT, and others) browse your catalog and place orders through your store's own endpoints. The data flows are:<\/p>\n\n<p><strong>Universal Commerce Protocol (ucp.dev) references.<\/strong> The <code>\/.well-known\/ucp<\/code> profile and REST responses contain fixed URLs such as <code>https:\/\/ucp.dev\/2026-08-25\/schemas\/shopping\/checkout.json<\/code> that identify which protocol version and schemas your store implements. Your server never calls these URLs; they are descriptive metadata for the platform. ucp.dev is an open specification (Apache License 2.0) maintained by the UCP Authors on GitHub.\nSpecification &amp; source: https:\/\/github.com\/Universal-Commerce-Protocol\/ucp\nLicense: https:\/\/github.com\/Universal-Commerce-Protocol\/ucp\/blob\/main\/LICENSE<\/p>\n\n<p><strong>Inbound requests from AI shopping platforms.<\/strong> Platforms call your REST, MCP and A2A endpoints directly to search the catalog, build carts and complete checkouts. Checkout-session and order ids are unguessable references known only to the platform that created them, and requests from a different platform profile are refused.<\/p>\n\n<p><strong>Fetching the calling platform's profile.<\/strong> UCP requires the store to fetch the profile URL each platform presents (in the <code>UCP-Agent<\/code> header or MCP <code>meta<\/code>), to negotiate capabilities. The store makes an HTTPS GET to that URL \u2014 no store or customer data is sent \u2014 refuses redirects and private\/loopback\/link-local addresses, bounds response size and time, and caches the result.<\/p>\n\n<p><strong>Order webhooks to platforms.<\/strong> When the platform that created an order advertises a <code>webhook_url<\/code> in its profile, the store POSTs the order (items, totals, shipping destination, refund\/cancellation adjustments \u2014 the same data the platform can already read at <code>GET \/orders\/{id}<\/code>) to that HTTPS URL when the order is placed and whenever it changes. Each delivery is signed with your store's key. Which platforms receive webhooks depends entirely on which platforms your customers use to place orders; the plugin sends to no platform on its own.<\/p>\n\n<p><strong>Optional payment handler \/ tokenizer.<\/strong> If you configure a Payment Handler (e.g. Stripe), card data is tokenized by that provider and the store charges the token through that provider's API. Consult that provider's own terms of service and privacy policy.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>wt-ucp-enabler-for-woocommerce<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate through the <strong>Plugins<\/strong> screen in WordPress admin.<\/li>\n<li>Go to <strong>WooCommerce \u2192 UCP Enabler<\/strong> to review settings, and generate a signing key under <strong>General \u2192 Signing Keys<\/strong>.<\/li>\n<li>Configure a Payment Handler (Stripe is auto-detected), or leave it empty to hand buyers off to your checkout for payment.<\/li>\n<li>Verify your profile is live at <code>https:\/\/yourstore.com\/.well-known\/ucp<\/code>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20work%20with%20woocommerce%20hpos%3F\"><h3>Does this work with WooCommerce HPOS?<\/h3><\/dt>\n<dd><p>Yes. The plugin declares full compatibility with WooCommerce High-Performance Order Storage (custom order tables).<\/p><\/dd>\n<dt id=\"which%20ucp%20spec%20version%20is%20implemented%3F\"><h3>Which UCP spec version is implemented?<\/h3><\/dt>\n<dd><p>Version <code>2026-08-25<\/code>, published at <code>\/.well-known\/ucp<\/code>. Version <code>2026-04-08<\/code> is also supported: the profile lists it under <code>supported_versions<\/code>, pointing to <code>\/.well-known\/ucp\/2026-04-08<\/code>, and each request is answered in the version the platform declares. Platforms using any other protocol version receive the spec's <code>version_unsupported<\/code> error.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20the%20woocommerce%20blocks%20%28cart%20%26%20checkout%20blocks%29%20checkout%3F\"><h3>Does it work with the WooCommerce Blocks (Cart &amp; Checkout blocks) checkout?<\/h3><\/dt>\n<dd><p>Yes. The buyer handoff (<code>continue_url<\/code>) and Embedded Checkout resume the checkout session's own order in both the Classic and the Blocks checkout.<\/p><\/dd>\n<dt id=\"can%20i%20disable%20individual%20capabilities%3F\"><h3>Can I disable individual capabilities?<\/h3><\/dt>\n<dd><p>Yes, under <strong>WooCommerce \u2192 UCP Enabler \u2192 General \u2192 Capabilities<\/strong>. Disabled capabilities are removed from the profile and their endpoints are not registered. Discount and Fulfillment are extensions and have no effect unless their parent capabilities are enabled.<\/p><\/dd>\n<dt id=\"which%20woocommerce%20coupon%20types%20are%20supported%20for%20discounts%3F\"><h3>Which WooCommerce coupon types are supported for discounts?<\/h3><\/dt>\n<dd><p>All of them \u2014 coupons are validated and applied by WooCommerce itself, so usage limits, minimum spend, product\/category restrictions and coupons from other extensions behave exactly as on your storefront.<\/p><\/dd>\n<dt id=\"the%20ai%20agent%20needs%20to%20charge%20a%20card%20%E2%80%94%20how%20does%20that%20work%3F\"><h3>The AI agent needs to charge a card \u2014 how does that work?<\/h3><\/dt>\n<dd><p>The agent obtains a token from the payment handler you advertise (e.g. Stripe) and submits it to <code>POST \/checkout-sessions\/{id}\/complete<\/code>. The Stripe handler charges it directly; for other providers, hook <code>wbte_ucp_enabler_process_payment<\/code> (see Payment Processing above). With no payment handler configured, checkouts report <code>requires_escalation<\/code> and the buyer pays on your checkout page via <code>continue_url<\/code>.<\/p><\/dd>\n<dt id=\"my%20store%20is%20behind%20a%20reverse%20proxy%20%2F%20cdn%20%E2%80%94%20what%20do%20i%20need%20to%20change%3F\"><h3>My store is behind a reverse proxy \/ CDN \u2014 what do I need to change?<\/h3><\/dt>\n<dd><p>Update the <strong>API Base Endpoint<\/strong> field under <strong>General<\/strong> to the public-facing URL your proxy exposes. Make sure your proxy passes the <code>UCP-Agent<\/code>, <code>Idempotency-Key<\/code>, <code>Authorization<\/code> and signature headers through unchanged, and does not re-serialize JSON responses (that would invalidate response signatures).<\/p><\/dd>\n<dt id=\"how%20do%20agents%20authenticate%20to%20a%20checkout%20session%20or%20order%3F\"><h3>How do agents authenticate to a checkout session or order?<\/h3><\/dt>\n<dd><p>Checkout-session ids (<code>chk_\u2026<\/code>) and order ids (<code>ord_\u2026<\/code>) are unguessable 128-bit references given only to the platform that created them; requests presenting a different platform profile are refused. Shop managers, and Identity-Linking tokens for the order's own customer, can always access them. Sessions created by earlier versions of this plugin (<code>ucp_{number}<\/code> ids) keep working with the bearer token they were issued.<\/p><\/dd>\n<dt id=\"i%27m%20testing%20with%20curl%20and%20get%20%60invalid_profile_url%60.\"><h3>I'm testing with curl and get `invalid_profile_url`.<\/h3><\/dt>\n<dd><p>UCP requires a <code>UCP-Agent: profile=\"https:\/\/\u2026\"<\/code> header naming the calling platform's profile. For manual testing you can turn off <strong>General \u2192 Require UCP-Agent<\/strong>; requests without the header are then served with every capability active.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.5<\/h4>\n\n<ul>\n<li>Updated to UCP 2026-08-25, with continued support for UCP 2026-04-08 platforms.<\/li>\n<li>New: agent shipping rates, store checkout handoff, signed order webhooks and request idempotency.<\/li>\n<li>Improved: all capabilities, MCP, A2A, Embedded Checkout and Identity Linking updated to the new spec.<\/li>\n<li>Security: duplicate-payment protection, stock and coupon re-checks, and safer Identity Linking tokens.<\/li>\n<li>Admin: redesigned Connected Apps list and Embedded tab toggles.<\/li>\n<li>Fix: 3D Secure payments, Stripe refunds, Embedded Checkout in cross-site frames, single shipping group for platforms without multi-group support and other bug fixes.<\/li>\n<li>Tested OK with WooCommerce 11.1.2<\/li>\n<\/ul>\n\n<h4>1.0.4<\/h4>\n\n<ul>\n<li>Identity Linking (dev.ucp.common.identity_linking): new OAuth 2.0 authorization flow (with PKCE) letting AI platforms link a shopper to their existing WordPress\/WooCommerce account. Off by default \u2014 configure under the new Identity Linking settings tab.<\/li>\n<li>Settings page reorganized: Capabilities and Signing Keys are now part of the General tab. No settings were removed; existing values carry over automatically.<\/li>\n<\/ul>\n\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>Tested OK with WP 7.1 and WooCommerce 11.0.1<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li><strong>Message signing<\/strong>: P-256 (ES256) key generation, rotation with a 7-day grace period, and revocation from <strong>WooCommerce \u2192 UCP Enabler \u2192 Signing Keys<\/strong> \u2014 private keys are generated server-side and encrypted at rest, never exposed in the admin UI.<\/li>\n<li><strong>Embedded Checkout &amp; Cart<\/strong>: adds the <code>embedded<\/code> transport, letting a host app show the store checkout\/cart inside its own screen instead of redirecting. Configurable under <strong>WooCommerce \u2192 UCP Enabler \u2192 Embedded<\/strong>.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li><strong>Stripe Payment Handler<\/strong> (<code>com.stripe.payments<\/code>): auto-detects and integrates with the official WooCommerce Stripe Gateway extension.<\/li>\n<li>MCP (Model Context Protocol) transport for all UCP shopping capabilities.<\/li>\n<li>A2A (Agent2Agent Protocol) transport for the Checkout capability.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Make your WooCommerce store discoverable and purchasable by AI shopping agents through the Universal Commerce Protocol (UCP).","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/335249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=335249"}],"author":[{"embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/webtoffee"}],"wp:attachment":[{"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=335249"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=335249"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=335249"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=335249"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=335249"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/id.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=335249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}