ACP and UCP: On-Chain Verification
for AI Agent Commerce

AI shopping agents are getting their own commerce protocols. OpenAI built ACP. Google built UCP. Both define how an agent requests and applies discounts during checkout. InsumerAPI is the first on-chain verification provider that supports both.

What Are ACP and UCP?

ACP (Agentic Commerce Protocol) is OpenAI and Stripe's standard for how AI agents interact with commerce APIs. It defines a structured format for discount objects with coupon IDs, percent-off values, start/end dates, and applied/rejected arrays. When an agent calls an ACP-compatible endpoint, it gets back a response it can feed directly into a Stripe checkout flow.

UCP (Universal Commerce Protocol) is Google's equivalent. It uses a simpler shape: a title string instead of a coupon object, an extension field for routing (dev.ucp.shopping.discount), and no start/end dates on individual discount entries. UCP is designed for Google Shopping and other Google commerce surfaces.

Both protocols solve the same problem: giving AI agents a predictable way to discover, request, and apply discounts without human intervention. For a step-by-step integration walkthrough, see the ACP discount endpoint integration guide.

How It Works

The flow is three steps:

1. Agent calls the ACP or UCP endpoint. The agent sends a wallet address and merchant ID to POST /v1/acp/discount or POST /v1/ucp/discount. InsumerAPI verifies the wallet's token holdings on-chain and returns a signed discount code in the requested protocol format.
2. Agent receives the discount. The response includes the discount percentage, an INSR-XXXXX code, an ECDSA signature proving authenticity, and the protocol-specific fields (coupon object for ACP, title string for UCP).
3. Merchant validates the code. At checkout, the merchant's backend calls GET /v1/codes/{code} to confirm the code is valid, unexpired, and unused. This endpoint is public. No API key needed.

The on-chain verification is identical for both endpoints. Only the response shape changes. For how agents discover these endpoints via credentials and discovery files, see our piece on the credentials route.

ACP vs UCP: Key Differences

Both endpoints accept the same request body (merchantId, wallet, optional solanaWallet, xrplWallet, and items). The differences are in the response:

• Discount identity. ACP uses a coupon object with id, name, and percent_off. UCP uses a flat title string.
• Timing fields. ACP includes start and end timestamps on each discount entry. UCP omits these; expiration lives only in the verification block.
• Extension field. UCP responses include "extension": "dev.ucp.shopping.discount" for protocol routing. ACP does not use extensions.
• Rejected array. ACP includes a rejected array when the wallet does not qualify. UCP returns an empty applied array instead.

Code Examples

ACP request:

curl -X POST \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"merchantId":"abc123","wallet":"0xd8dA...96045"}' \
  https://api.insumermodel.com/v1/acp/discount

UCP request:

curl -X POST \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"merchantId":"abc123","wallet":"0xd8dA...96045"}' \
  https://api.insumermodel.com/v1/ucp/discount

Validate a code (public, no key):

curl https://api.insumermodel.com/v1/codes/INSR-A7K3M

The validation response returns valid: true with the discount percentage, merchant ID, and expiration, or valid: false with a reason (expired, already_used, or not_found).

Why On-Chain Verification Matters for Agent Commerce

No PII required. The agent sends a wallet address. InsumerAPI verifies holdings on-chain and returns a boolean result with a discount percentage. No name, email, or personal data is collected or transmitted.

Cryptographically signed. Every response includes an ECDSA P-256 signature. The merchant can verify the signature against the published JWKS endpoint at /.well-known/jwks.json to confirm the discount code was issued by InsumerAPI and has not been tampered with.

Protocol-native. Agents built on OpenAI's commerce stack can consume ACP responses directly. Agents built on Google's stack can consume UCP responses directly. No adapter code, no format translation.

One credit, one verification. Both endpoints consume exactly 1 merchant credit per call. The verification logic is identical. You choose which response format your agent needs. For how this fits into the broader agentic commerce landscape, see our breakdown of what happens before an agent pays.

Full API reference for all three endpoints is on the commerce docs.